Enswitch
Monthly
Unauthenticated password reset bypass in Integrics Enswitch 3.13 through 4.4 allows remote attackers to change passwords for accounts that have no pending reset by omitting the reset parameter, causing the empty reset_key to match the defaulted empty value; this enables administrator account takeover after enumerating valid usernames. Publicly available exploit code exists, and the vulnerability is remotely exploitable without authentication or user interaction, making it a genuine high-priority issue.
Unauthenticated password reset bypass in Integrics Enswitch 3.13 through 4.4 allows remote attackers to change passwords for accounts that have no pending reset by omitting the reset parameter, causing the empty reset_key to match the defaulted empty value; this enables administrator account takeover after enumerating valid usernames. Publicly available exploit code exists, and the vulnerability is remotely exploitable without authentication or user interaction, making it a genuine high-priority issue.