PT-2025-11454 · Zoho · Zoho Analytics+1

Muhammed Mekkawy · Published 2025-03-17 · Updated 2025-03-22 · CVE-2025-1724

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine Analytics Plus versions prior to 6130 Zoho Analytics versions prior to 6130

Description The issue is related to an AD only account takeover due to a hardcoded sensitive token. This allows for unauthorized access. The estimated number of potentially affected devices is not provided.

Recommendations For ManageEngine Analytics Plus versions prior to 6130, update to version 6130 or later. For Zoho Analytics versions prior to 6130, update to version 6130 or later. As a temporary workaround, consider restricting access to sensitive areas of the application until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-1724

Affected Products

Manageengine Analytics Plus

Zoho Analytics

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-1724 · Security Note
• https://twitter.com/CVEnew/status/1901532814614663411 · Twitter Post
• https://twitter.com/cracbot/status/1903401356503011329 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1jdi3z7/manageengine_vulnerability_exposes_user_accounts · Reddit Post
• https://t.me/cvetracker/19257 · Telegram Post
• https://twitter.com/syedaquib77/status/1901647086648762863 · Twitter Post
• https://manageengine.com/analytics-plus/CVE-2025-1724.html · Note
• https://zoho.com/analytics/onpremise/CVE-2025-1724.html · Note
• https://t.me/cvedetector/20435 · Telegram Post
• https://t.me/latest_high_impact_cve/1982 · Telegram Post