CVE-2017-14005

Summary

An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a user's password, enabling future access and possible configuration changes.

Affected Software

Weaknesses

• CWE-620: CWE-620

ADP Enrichment

CVE Program Container

Additional References

• http://www.securityfocus.com/bid/101259
• https://ics-cert.us-cert.gov/advisories/ICSA-17-285-01

References

• http://www.securityfocus.com/bid/101259
• https://ics-cert.us-cert.gov/advisories/ICSA-17-285-01

• ←Previous
• Next→