CVE-2014-7862

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 81.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-01-04 · updated 2026-06-17
Weakness: CWE-264

Description

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

Affected products

Zohocorp Desktop Central: before 90109; from 7 — fixed in 90109

How to fix

Upgrade to a fixed version: Zohocorp Desktop Central 90109. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
http://seclists.org/fulldisclosure/2015/Jan/2
http://www.securityfocus.com/archive/1/534356/100/0/threaded
http://www.securityfocus.com/bid/71849
https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt
https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html
https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin
http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
http://seclists.org/fulldisclosure/2015/Jan/2
http://www.securityfocus.com/archive/1/534356/100/0/threaded
http://www.securityfocus.com/bid/71849

Get alerted when CVE-2014-7862 or the next vulnerability affects your stack