Zoho zero-day published on Twitter

A security researcher published yesterday details on Twitter about a zero-day vulnerability in a Zoho enterprise product. Cyber-security experts who have reviewed the vulnerability have told ZDNet that the zero-day could spell trouble for companies around the world, as it could be an entry point for ransomware gangs to infect corporate networks and ransom their data. The vulnerability impacts the Zoho ManageEngine Desktop Central. According to the Zoho website, this is an endpoint management solution. Companies use the product to control their fleets of devices -- such as Android smartphones, Linux servers, or Mac and Windows workstations. The product works as a central server inside a company, allowing system administrators to push updates, take control over systems remotely, lock devices, apply access restrictions, and more. Yesterday, a security researcher named Steven Seeley, published details, along with proof-of-concept demo code, about an unpatched bug in this product. "This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Desktop Central," Seeley said. The (attacker's) code is executed without the need for authentication, and the code runs with root privileges on the machine, Seeley added. This effectively means that hackers can take full control over ManageEngine systems, and a company's fleet of devices. Products like Zoho's ManageEngine are often employed by companies that provide remote IT support -- called ...