PT-2018-4293 · Zoho · Manageengine Desktop Central

Pedro Ribeiro · Published 2018-01-04 · Updated 2018-10-09 · CVE-2014-7862

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to build 90109 ManageEngine Desktop Central MSP versions prior to build 90109

Description The issue allows remote attackers to create administrator accounts. This is achieved through the DCPluginServelet servlet via an addPlugInUser action.

Recommendations For ManageEngine Desktop Central versions prior to build 90109, update to build 90109 or later. For ManageEngine Desktop Central MSP versions prior to build 90109, update to build 90109 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2025-12730

CVE-2014-7862

Affected Products

Manageengine Desktop Central

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb · Exploit
• 🔥 https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt · Exploit
• 🔥 https://exploit-db.com/exploits/43892 · Exploit
• 🔥 https://rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-7862 · Security Note
• https://bdu.fstec.ru/vul/2025-12730 · Security Note
• https://manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html · Note
• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html · Note
• https://securitycode.ru/company/blog/daydzhest-laboratorii-analiza-setevykh-ugroz-kod-bezopasnosti-za-mart-2025 · Note
• https://seclists.org/fulldisclosure/2015/Jan/2 · Note
• http://securityfocus.com/bid/71849 · Note
• http://seclists.org/fulldisclosure/2015/Jan/2 · Note
• http://securityfocus.com/archive/1/534356/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595 · Note