EUVD-2026-45220
GHSA-jwxw-5646-6rgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed platform
-
DeliveryLocate password-change/reset endpoint
-
ExploitSubmit unverified password change for target
-
ExecutionSet attacker-controlled password
-
PersistLog in as victim
-
ImpactFull account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Password change verification
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Vimesoft Enterprise Video Platform, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation requires only network reachability to the application's password-change/reset functionality; no valid credentials, no user interaction, and no elevated privileges are needed. The main limiting factors are deployment-related: the instance must be network-accessible to the attacker (internet-facing instances are most exposed; VPN- or allowlist-restricted deployments are far less reachable), and the target must be running an affected version in the 3.11.0.0 to pre-3.25.0 range. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact on the compromised account - consistent with account takeover via an unverified password change. This is a genuinely high-priority pattern: no privileges, no user interaction, and a repeatable primitive that is typically automatable. However, key corroborating signals are missing: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC/exploit reference was supplied - so real-world exploitation is inferred-plausible rather than observed. SSVC-style reasoning would put Exploitation=none-observed, Automatable=likely-yes (network, unauthenticated, low complexity), Technical Impact=total for the account. Net: prioritize patching based on ease and impact, while noting exploitation is not yet confirmed in the wild. |
| Exploit ScenarioDerived | An attacker who can reach the platform over the network sends a crafted request to the password-change/reset endpoint for a target user, and because the current credential or a valid reset token is not verified, the server sets an attacker-chosen password. The attacker then authenticates as that user and gains full control of the account. No public exploit code was identified, but the low attack complexity and lack of authentication make the attack straightforward to script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
Authentication bypass in Vimesoft Enterprise Video Platform (versions 3.11.0.0 up to but not including 3.25.0) lets a remote, unauthenticated attacker change a victim's password without verifying the existing credential (CWE-620), enabling full account takeover. Reported by Turkey's national CERT (TR-CERT/USOM) and rated CVSS 9.8, the flaw grants complete control over targeted accounts. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade Enterprise Video Platform to version 3.25.0 or later, which is the first fixed release for the 3.11.0.0-3.24.x affected range. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0574 for vendor guidance. If immediate patching is not possible, restrict network reachability of the platform's password-change and password-reset endpoints - place the application behind a VPN or IP allowlist and add a WAF/reverse-proxy rule to block or authenticate requests to the account-recovery and change-password routes - accepting that this may break legitimate self-service password resets for remote users. As additional compensating measures, force password resets and invalidate active sessions for any accounts suspected of tampering, and monitor logs for anomalous password-change requests; these controls reduce exposure but do not remove the underlying flaw, so upgrading remains the primary fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is Vimesoft Inc.'s Enterprise Video Platform, a commercial video conferencing/streaming solution (CPE cpe:2.3:a:vimesoft_inc.:enterprise_video_platform). The root cause is CWE-620 (Unverified Password Change): a password-change or password-reset routine that sets a new password without validating the requester's identity - for example, not requiring the current password, a valid authenticated session, or a properly bound reset token. When that check is absent, the password-change endpoint itself becomes an authentication-bypass primitive, because whoever can reach it can overwrite a target account's credential and then log in as that user.
Know when Enterprise Video Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable password-change endpoint requires no auth or interaction (AV:N/AC:L/PR:N/UI:N); account takeover yields full C/I/A impact within the app's unchanged scope.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass.
This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.
Executive ViewAI
Vimesoft Enterprise Video Platform versions 3.11.0.0 through 3.24.x contain a critical unauthenticated password-reset vulnerability (CVSS 9.8) enabling remote attackers to seize control of any user account without credential verification. Organizations running these versions face immediate risk of account takeover, unauthorized data access, and credential misuse across the platform with no vendor patch currently available.
Restrict network access to Vimesoft instances through segmentation and IP whitelisting; enable comprehensive audit logging of all account changes and authentication events; enforce multi-factor authentication on all user accounts; apply principle-of-least-privilege access controls; deploy continuous monitoring for anomalous login patterns, account resets from unfamiliar sources, or bulk password-change activity; consider temporary operational suspension of non-critical instances pending vendor patch release; establish incident response procedures to investigate and remediate any accounts modified during the exposure period.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB