Trusted Design

ManageEngine OpManager Remote Code Execution

概要

This Metasploit module exploits a default credential vulnerability in ManageEngine OpManager, where a default hidden account "IntegrationUser" with administrator privileges exists. The account has a default password of "plugin" which can not be reset through the user interface. By log-in and abusing the default administrator's SQL query functionality, it's possible to write a WAR payload to disk and trigger an automatic deployment of this payload. This Metasploit module has been tested successfully on OpManager v11.5 and v11.6 for Windows.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• ManageEngine OpManager 11.5 Hardcoded Credential / SQL Bypass (score: 0.64)
• Zemra Botnet CnC Web Panel Remote Code Execution (score: 0.55)
• ManageEngine EventLog Analyzer Remote Code Execution (score: 0.54)
• w3tw0rk / Pitbul IRC Bot Remote Code Execution (score: 0.47)
• MS15-100 Microsoft Windows Media Center MCL Code Execution (score: 0.45)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る