Vulnerability Description
EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netikus | Eventsentry | < 6.0.1.20 |
Related Weaknesses (CWE)
References
- https://www.eventsentry.com/downloads/version-historyRelease Notes
- https://www.vulncheck.com/advisories/eventsentry-web-reports-unverified-passwordVDB EntryVendor Advisory
FAQ
What is CVE-2026-24443?
CVE-2026-24443 is a vulnerability with a CVSS score of 8.8 (HIGH). EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not ...
How severe is CVE-2026-24443?
CVE-2026-24443 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-24443?
Check the references section above for vendor advisories and patch information. Affected products include: Netikus Eventsentry.