Description
An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a user's password, enabling future access and possible configuration changes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ProMinent MultiFLEX M10a Controller | ProMinent MultiFLEX M10a Controller | — |
Advisories 1
- ICSA-17-285-01 ProMinent MultiFLEX M10a Controller CISA ICS & IT advisories · Oct 12, 2017