CVE-2025-1724

High

Published: 17 March 2025

Published

17 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0132 80.3th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1724 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Manageengine (inferred from references). Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Domain Accounts (T1078.002); ranked in the top 19.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).

Deeper analysis

Zohocorp ManageEngine Analytics Plus and Zoho Analytics on-premise versions prior to 6130 contain a hardcoded sensitive token that enables an Active Directory-only account takeover. The flaw is tracked as CVE-2025-1724 and carries a CVSS 3.1 score of 7.4, reflecting network attack vectors, high attack complexity, and no required privileges or user interaction. It is classified under CWE-798 for use of hard-coded credentials.

An unauthenticated remote attacker who obtains the embedded token can impersonate or seize control of AD-integrated accounts within the affected analytics deployments, resulting in high impact to confidentiality and integrity. The vulnerability does not affect availability and is limited to on-premise installations that have not been upgraded past the 6130 release threshold.

Official advisories published by ManageEngine and Zoho at the referenced URLs direct administrators to apply the 6130 or later builds to eliminate the hardcoded token. The associated EPSS scores remain low, with a current value of 0.0132 and a recorded peak of 0.0226.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-6463

Vulnerability details

Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token.

CWE(s): CWE-798

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.002 Domain Accounts Stealth

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Hardcoded token enables remote AD account takeover (T1078.002 Domain Accounts) via network-accessible on-premise analytics application (T1190 Exploit Public-Facing Application).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0