CVE-2014-7862

CRITICAL

ManageEngine Desktop Central < 90109 - Unauthenticated Administrator Account Creation via DCPluginServelet

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2014-7862. PoCs published by Pedro Ribeiro, including Metasploit module auxiliary/admin/http/manage_engine_dc_create_admin.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated administrator account creation vulnerability in ManageEngine Desktop Central. By sending a crafted GET request to the DCPluginServelet endpoint, an attacker can create a new admin user with a known password, enabling full control over managed devices.

Description

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

Exploits (2)

exploitdb WORKING POC

by Pedro Ribeiro · textwebappsmultiple

https://www.exploit-db.com/exploits/43892

View Code ZIP pw:eip

This exploit demonstrates an unauthenticated administrator account creation vulnerability in ManageEngine Desktop Central. By sending a crafted GET request to the DCPluginServelet endpoint, an attacker can create a new admin user with a known password, enabling full control over managed devices.

Classification

Working Poc 100%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: ManageEngine Desktop Central (versions 7 onwards, pre-9.0 build 90109)

No auth needed

Prerequisites: Network access to the target server

MITRE ATT&CK

T1110.001 - Password Guessing T1078 - Valid Accounts

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC

rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb