Description
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CRIXP | OpenCRX | 4.30 – ≤ 4.30, 5.0-20200717 – ≤ 5.0-20200717 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
ruthvikvegunta/openCRX-CVE-2020-7378 ★ 5 · Jul 6, 2021
Exploits Password Reset Vulnerability in OpenCRX, CVE-2020-7378. Also maintains Stealth by deleting all the password reset mails created by the script
-
loganpkinfosec/CVE-2020-7378 ★ 0 · Jun 27, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.