# ADV-2025-013 - Hard-coded Password in Netwrix Directory Manager (formerly Imanami GroupID) v10 and Earlier

**URL:** <https://community.netwrix.com/t/adv-2025-013-hard-coded-password-in-netwrix-directory-manager-formerly-imanami-groupid-v10-and-earlier/13945>\
**Category:** Directory Manager Security Advisories\
**Tags:** security-advisory, directory-manager-security-advisory\
**Created:** [May 14, 2025, 6:05pm UTC](https://community.netwrix.com/t/adv-2025-013-hard-coded-password-in-netwrix-directory-manager-formerly-imanami-groupid-v10-and-earlier/13945 "2025-05-14T18:05:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![netwrix-product-security](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-product-security/32/3102_2.png) [@netwrix-product-security](https://community.netwrix.com/u/netwrix-product-security)\
**Post date:** [May 14, 2025, 6:05pm UTC](https://community.netwrix.com/t/adv-2025-013-hard-coded-password-in-netwrix-directory-manager-formerly-imanami-groupid-v10-and-earlier/13945/1 "2025-05-14T18:05:05Z")

</div>

# Executive Summary

Netwrix _strongly advises_ customers review this advisory and take the recommended actions without delay.

In Netwrix Directory Manager (formerly Imanami GroupID) v10 and earlier, a hard-coded password was used by the product, which could be used to authenticate as an administrator to the Windows server on which Netwrix Directory Manager is installed or to the product itself. Beginning in v9, this hard-coded password was replaced with customer-supplied credentials. However, this hard-coded user was not removed from the Netwrix Directory Manager installer and thus persists on the Windows server. Conditions may also exist where customers who upgraded from an earlier version of Netwrix Directory Manager to v10 could continue to use the hard-coded password for the Netwrix Directory Manager product.

# Vulnerability

| Title | Affected Component | Affected Versions | CVSS 4.0 Score | CVSS 3.1 Score (Base / Temporal) | Description |
| --- | --- | --- | --- | --- | --- |
| Hard-coded Password in Netwrix Directory Manager (CVE-2025-48748) | Netwrix Directory Manager | \<=10.0.7784.0 | [10.0](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:H/U:Red) | [10.0 / 9.0](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) | Netwrix Directory Manager v10 and earlier include a hard-coded password, which may be used to authenticate as an administrator to the Windows server on which Netwrix Directory Manager is installed or the product itself. Though this password is no longer used beginning in Netwrix Directory Manager v9, the user persisted on the Windows server, and conditions may exist where Netwrix Directory Manager v9 and v10 still utilize the credential. This credential may allow an attacker with the ability to communicate over any network on which Netwrix Directory Manager is accessible to compromise Netwrix Directory Manager and any integrated Identity Stores. |

# Exploitability

Factors such as whether details about the vulnerability are publicly known, whether an exploit is readily available, or whether adversaries are actively exploiting the vulnerability are valuable in making risk-based judgments about urgency and priority; customers should use the information below in making those decisions.

| Title | Publicly known? | Exploit available? | Actively exploited? |
| --- | --- | --- | --- |
| Hard-coded Password in Netwrix Directory Manager (CVE-2025-48748) | No | No | No |

# Solution

All customers are advised to disable internet access to Netwrix Directory Manager until such time as the actions recommended in this advisory are taken.

Customers running a version of Netwrix Directory Manager earlier than v10 SR2 (10.0.7784.0) are advised to update to the latest release of v10, as prior versions are [no longer supported](https://www.netwrix.com/supported_versions.html).

All customers running v10 SR2 (10.0.7784.0) and earlier are advised to examine the Microsoft Internet Information Services (IIS) Application Pools for the use of the `GroupIDSSUser` as the Application Pool Identity.

Netwrix has [published instructions](https://helpcenter.netwrix.com/bundle/GroupID_10.0_NDM10-ADV-2025-013-Utility/resource/GroupID_10.0_NDM10-ADV-2025-013-Utility.pdf) for manually assessing whether a vulnerable condition is present and remediating it, and [a utility](https://releases.netwrix.com/products/groupid/10.0/NDM10-ADV-2025-013-Utility.zip) for aiding this assessment.

If the `GroupIDSSUser` is determined to be used to run any IIS Application Pool, Netwrix advises customers to create a new service account within their control and update the Application Pool Identity for each Application Pool to this user. The `GroupIDSSUser` local Windows account should then be deleted.

Additionally, this tool will apply an IIS IP Security Rule to internal Netwrix Directory Manager services, which will prevent remote access to them. This may affect customers who use the Netwrix Directory Manager Admin Center MMC or PowerShell interface externally. Netwrix advises customers to operate these utilities from the Netwrix Directory Manager server.

Please contact the [Netwrix technical support team](https://www.netwrix.com/support.html#contact-us) should you need assistance.

# FAQ

1. **How do I determine which version of Netwrix Directory Manager is in use?**

2. **What should I do if I have an Netwrix Directory Manager deployment exposed to the internet?**

# Revisions

Updates to this advisory may be made as necessary. Information about each change will be published in the table below.

| Revision | Date | Description |
| --- | --- | --- |
| 2 | 2025-05-28T12:00:00Z | Add assigned CVE |
| 1 | 2025-05-14T18:00:00Z | First published |

# Disclaimer

The information and materials included in or linked to this Security Advisory are provided on an “as-is” basis and without warranty of any kind, and we disclaim all representations and warranties of any kind, whether express or implied, including warranties of merchantability and fitness for a particular use. You acknowledge and agree that your use of the information and materials included in or linked to this Security Advisory are at your own risk.

---

<div class="post-metadata">

**Author:** ![netwrix-product-security](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/netwrix-product-security/32/3102_2.png) [@netwrix-product-security](https://community.netwrix.com/u/netwrix-product-security)\
**Post date:** [May 28, 2025, 12:02pm UTC](https://community.netwrix.com/t/adv-2025-013-hard-coded-password-in-netwrix-directory-manager-formerly-imanami-groupid-v10-and-earlier/13945/2 "2025-05-28T12:02:27Z")

</div>

_An update was made to this advisory._