CVE-2024-28143

creationtimestamp| type| source ---|---|--- 2024-12-12 13:55:44+00:00| seen| https://infosec.exchange/users/cve/statuses/113640193636487541 2024-12-12 16:20:46+00:00| seen| https://t.me/cvedetector/12789...

CVE-2024-28143 Insecure Password Change Function

The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e....