CVE-2017-14005
17.10.2017, 22:29
An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a user's password, enabling future access and possible configuration changes.Enginsight
| Vendor | Product | Version |
|---|---|---|
| prominent | multiflex_m10a_controller_firmware | * |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-620 - Unverified Password ChangeWhen setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
- CWE-640 - Weak Password Recovery Mechanism for Forgotten PasswordThe software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.