CVE-2014-5377

ManageEngine DeviceExpert < 5.9 - Unauthenticated Exposure of Sensitive Information via ReadUsersFromMasterServlet

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2014-5377. PoCs published by Pedro Ribeiro, including Metasploit module auxiliary/scanner/http/manageengine_deviceexpert_user_creds.

AI-analyzed exploit summary This exploit discloses user credentials from ManageEngine DeviceExpert 5.9 by making a GET request to an unauthenticated endpoint, returning usernames, roles, salted MD5 password hashes, and salt values in XML format.

Description

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.

Exploits (2)

exploitdb WORKING POC
by Pedro Ribeiro · textwebappsmultiple
https://www.exploit-db.com/exploits/34449

This exploit discloses user credentials from ManageEngine DeviceExpert 5.9 by making a GET request to an unauthenticated endpoint, returning usernames, roles, salted MD5 password hashes, and salt values in XML format.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: ManageEngine DeviceExpert 5.9 build 5980
No auth needed
Prerequisites: Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/manageengine_deviceexpert_user_creds.rb

This Metasploit module exploits an information disclosure vulnerability in ManageEngine DeviceExpert to extract usernames and salted MD5 password hashes. It also attempts to crack weak passwords using a predefined list.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: ManageEngine DeviceExpert version 5.9 build 5980 and prior
No auth needed
Prerequisites: Network access to the target device on port 6060 (or 443 if SSL is used)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (10)

Core 10
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/34449
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Aug/75
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69443
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/533250/100/0/threaded
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Aug/84
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95562
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Aug/76

Scores

EPSS 0.5747
EPSS Percentile 99.0%

Details

CWE
CWE-200
Status published
Products (1)
manageengine/device_expert < 5.9
Published Sep 04, 2014
Tracked Since Feb 18, 2026