Integrics Enswitch CVE-2026-107640

Exploitation targets the /api/json/user/password/update/ endpoint and requires that the attacker (1) know or enumerate a valid username (the description explicitly notes exploitation follows username enumeration) and (2) target an account with NO pending password reset, so that the account's defaulted empty reset_key matches the empty value produced by omitting the reset parameter. The limiting factors are therefore: the account must not currently have an active/pending reset in progress, and the attacker must identify a valid (ideally administrator) username; there is otherwise no authentication, no user interaction, and no non-default configuration required (AV:N/AC:L/PR:N/UI:N), and the affected versions are Integrics Enswitch 3.13 through 4.4.

This is a genuine high-priority issue, not an inflated high-CVSS artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, and the description corroborates it: an unauthenticated attacker changes arbitrary account passwords by omitting the reset parameter so an empty reset_key matches the defaulted empty value. The CVSS vector and the description are consistent (both point to remote, pre-authentication exploitation), which strengthens confidence. Public exploit code exists (per the enablesecurity.com advisory tagged as exploit and VulnCheck's advisory), raising practical risk, though this is distinct from confirmed active exploitation. No EPSS score was supplied, so exploitation-probability modeling cannot be cited, and the CVE is NOT listed in CISA KEV at time of analysis - so there is no evidence of in-the-wild use yet, only readily available tooling. The main realistic brake on mass exploitation is that attackers must first enumerate valid usernames and target accounts with no pending reset; against a known-admin username this is trivial. Impact is confidentiality and integrity to administrator accounts (VC:H/VI:H) with no direct availability impact (VA:N).

An unauthenticated attacker enumerates valid usernames on an internet-reachable Enswitch deployment, then sends a crafted request to /api/json/user/password/update/ that omits the reset parameter, causing the supplied empty reset_key to match the account's defaulted empty reset_key. Public exploit code for this password-reset bypass is available (EnableSecurity/VulnCheck advisories), so the attacker resets an administrator's password and logs in with full control. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required beyond knowing a target username.