CVE-2021-37762

Vulnerability

The vulnerability exists in Zoho ManageEngine ADManager Plus version 7110 and prior. It allows unrestricted file overwrite, enabling an attacker to overwrite arbitrary files on the server [1].

Exploitation

An attacker can exploit this by sending crafted requests to overwrite files. The exact prerequisites are not disclosed in available references, but likely require network access and possibly authentication depending on the affected endpoint.

Impact

Successful exploitation leads to remote code execution, as the attacker can overwrite critical files (e.g., configuration or executable files) to gain control of the server.

Mitigation

The issue is fixed in version 7111 [1]. Users should upgrade to version 7111 or later. No workaround is mentioned in the available references.