An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a userβs password, enabling future access and possible configuration changes.
[
{
"product": "ProMinent MultiFLEX M10a Controller",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "ProMinent MultiFLEX M10a Controller"
}
]
}
]