CVE-2021-42956 Explained : Impact and Mitigation

Zoho Remote Access Plus Server Windows Desktop Binary fixed in version 10.1.2132.6 is affected by a sensitive information disclosure vulnerability which allows attackers to dump sensitive data.

Understanding CVE-2021-42956

What is CVE-2021-42956?

Zoho Remote Access Plus Server Windows Desktop Binary has a vulnerability that enables unauthorized users to perform memory dumps, leading to the exposure of critical information.

The Impact of CVE-2021-42956

The vulnerability has a CVSS base score of 7.8 with high impacts on confidentiality, integrity, and availability. Attackers can extract sensitive information like database connection strings, IT infrastructure details, and credentials.

Technical Details of CVE-2021-42956

Vulnerability Description

Due to improper privilege management, the process of Zoho Remote Access Plus Server launches as the logged-in user, allowing unauthorized memory dumps.

Affected Systems and Versions

Affected Product: Zoho Remote Access Plus Server Windows Desktop Binary
Affected Version: 10.1.2132.6

Exploitation Mechanism

The vulnerability can be exploited locally with low privileges required, enabling attackers to retrieve critical information without user interaction.

Mitigation and Prevention

Immediate Steps to Take

Upgrade: Update Zoho Remote Access Plus Server to version 10.1.2132.6 to mitigate the vulnerability.
Restrict Access: Limit access to the server to authorized personnel only.

Long-Term Security Practices

Regular Audits: Conduct periodic security audits to identify and address vulnerabilities.
User Training: Educate users on the importance of secure practices to prevent unauthorized access.

Patching and Updates

Monitor Releases: Stay informed about security updates and patches released by Zoho for ongoing protection.