CVE-2015-2794: DotNetNuke install wizard allows unauthenticated reinstall and SuperUser takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote reinstall leading to SuperUser takeover with a CVSS 3.0 score of 9.8 and very high EPSS, plus a public exploit.

What it is

The installation wizard in DotNetNuke (DNN) before 7.4.1 can be reached directly at Install/InstallWizard.aspx and used to reinstall the application. Because the wizard is not protected after setup, a remote attacker can rerun it and take over the site. This is a critical access-control failure that grants full administrative control of the platform.

Impact

An attacker gains SuperUser access to the DNN instance, allowing full control of site content, configuration and hosted data. Depending on the deployment, this can lead to further compromise of the underlying host or connected systems.

Attack surface

Reached over the network by a direct HTTP request to Install/InstallWizard.aspx. The CVSS vector shows no privileges and no user interaction required, so the request can be sent directly by an unauthenticated attacker.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.74552, 99.47th percentile) and a public Exploit-DB entry (39777) exists, indicating known public exploitation techniques. No ransomware group usage is documented in the record.

What to do

• Upgrade DotNetNuke to 7.4.1 or later, which is the fixed release per the vendor security center.
• If immediate upgrade is not possible, apply the vendor workaround to block or remove access to Install/InstallWizard.aspx.
• Restrict or block external access to the /Install/ path at the web server or WAF until patched.
• Verify the installation wizard is disabled or removed after setup and confirm no residual installer files remain.
• Review DNN SuperUser accounts and logs for unauthorized creation or changes after exposure.

Detection

• Monitor web logs for requests to Install/InstallWizard.aspx, especially from external or unexpected source IPs.
• Alert on creation of new SuperUser or administrative accounts in DNN, particularly outside change windows.
• Look for POST requests to the install path followed by administrative actions or configuration changes.
• Correlate any installer-path access with subsequent authentication events or file changes on the DNN host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.