CVE-2020-11532: ManageEngine DataSecurity Plus default admin credentials allow auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction required, and very high EPSS make this an urgent patch-and-rotate item despite no KEV listing.

What it is

Zoho ManageEngine DataSecurity Plus before 6.0.1 ships with default admin credentials used to communicate with a DataEngine Xnode server. An attacker who knows or guesses those defaults can bypass authentication and act as the admin user. The flaw is a classic insecure default initialization issue affecting a security product, which raises the stakes because the compromised component is meant to protect data.

Impact

An attacker gains full admin-level control over the DataEngine Xnode server, allowing execution of all operations in the admin context. That can expose or alter sensitive data managed by the product.

Attack surface

Reachable over the network via the DataEngine Xnode server interface with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only prerequisite is knowledge of the default credentials.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.775 (99.5th percentile) and public exploit references exist on Packet Storm and Full Disclosure, indicating active interest and likely weaponization.

What to do

• Upgrade DataSecurity Plus to build 6013 (6.0.1) or later per the vendor advisory.
• Immediately change all default admin credentials on DataEngine Xnode servers and any related ManageEngine components.
• Restrict network access to the DataEngine Xnode server so only trusted management hosts can reach it.
• Audit for other ManageEngine deployments still using default or shared credentials and rotate them.
• Monitor vendor advisories for follow-up patches affecting the same product line.

Detection

• Search authentication logs for successful logins to the DataEngine Xnode server using default or known admin account names.
• Alert on admin-context operations originating from unexpected source IPs or outside maintenance windows.
• Baseline normal DataEngine Xnode traffic and flag new or anomalous clients connecting to its service port.
• Hunt for the public exploit artifacts referenced in Packet Storm and Full Disclosure against exposed ManageEngine instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.