EventSentry < 6.0.1.20 Web Reports Unverified Password Change
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NETIKUS.NET ltd | EventSentry | before 6.0.1.20 | 6.0.1.20 | Patch available | CNA |
- EventSentry VendorNETIKUS.NET ltd Affected before 6.0.1.20 Fixed in 6.0.1.20 Patch available CNA
Remediation
- Fix · CNA EventSentry (NETIKUS.NET ltd) Fixed in 6.0.1.20
Timeline
- 2026-10-02 Threatist record created from CVE-2026-24443
- 2026-10-03 Alias added: GHSA-8c83-cvgq-pp7w
References
More Netikus Eventsentry vulnerabilities
- TI-2016-04394 Netikus EventSentry before 3.2.1.44 has XSS via SNMP. CVSS 3.0MEDIUM 6.1
Sources
- CVE-2026-24443 · CVE Program
- CVE-2026-24443 · NVD
- FIRST EPSS
- GHSA-8c83-cvgq-pp7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences