CVE-2025-48748

Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password

Critical · published May 29, 2025

CVSS v3.1
10.0
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

🔥 A hard-coded password in Netwrix Directory Manager? That's like leaving your front door open with the key under the mat! Imagine a hotel where every guest room has the same keycard — not very secure, right? This vulnerability allows anyone who knows the password to access sensitive configurations, just like an intruder walking into any room with a master key. An attacker could gain unauthorized access to the system and manipulate crucial directory settings, potentially leading to data breaches, unauthorized modifications, and devastating consequences for your organization's security posture. This is absolutely devastating!

Put simply

Imagine a hotel where every guest room has the same keycard — not very secure, right? This vulnerability allows anyone who knows the password to access sensitive configurations, just like an intruder walking into any room with a master key. The vulnerability arises from a hard-coded password in versions up to 10.0.7784.0, allowing attackers to gain access without needing any credentials from the legitimate users, effectively bypassing authentication altogether.

What to do

An attacker could gain unauthorized access to the system and manipulate crucial directory settings, potentially leading to data breaches, unauthorized modifications, and devastating consequences for your organization's security posture. This is absolutely devastating! Immediately update to version 10.0.7785.0 or later to eliminate this hard-coded password issue. Additionally, review your security policies to assess any potential risks associated with unauthorized access. Don't let complacency set in! You've got this! With these updates, you'll be sealing up those vulnerabilities in no time! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Published
2025-05-29T00:00Z
EPSS history
Timeline
  • 29 MAY 00:00Z
    Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password
    cvelistv5