CVE-2017-14009

The CVE-2017-14009 vulnerability affects ProMinent MultiFLEX M10a Controller web interface. An authenticated user changing their password causes the current password to be exposed in plaintext, enabling an already-authenticated attacker to obtain the user’s password. This Information Exposure ste...

CVE-2017-14005

The CVE is for ProMinent MultiFLEX M10a Controller web interface. Affected: all versions of the MultiFLEX M10a Controller web UI. Issue: Unverified Password Change allows an authenticated attacker to change a user’s password, enabling future access and potential configuration changes. Impact: hig...

CVE-2017-14011

CVE-2017-14011 affects the ProMinent MultiFLEX M10a Controller web interface. The vulnerability is a Cross-Site Request Forgery arising from insufficient verification of requests in the application, which may allow an attacker to perform unauthorized actions and change the device configuration. A...

CVE-2017-14007

CVE-2017-14007 affects the ProMinent MultiFLEX M10a Controller web interface. The issue is Insufficient Session Expiration: a user’s session remains usable beyond the last activity, allowing an attacker to reuse an old session for authorization. Public sources (NVD) document the vulnerability wit...

ProMinent MultiFLEX M10a Controller Session Stealing Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. A session stealing vulnerability exists in ProMinent MultiFLEX M10a Controller, where a user's session can be used for a period of time longer than the last activity, which can be exploited by an attacker to reuse an old session for...

ProMinent MultiFLEX M10a Controller Authentication Bypass Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. An authentication bypass vulnerability exists in ProMinent MultiFLEX M10a Controller, where the logout feature in the application deletes a user's session on the client side only. An attacker can exploit the vulnerability to bypass...