A remote unauthenticated user can change the password of any Manage Engine Desktop Central user with the Administrator role (DCAdmin).