Netikus EventSentry up to 6.0.1.20 Web Reports Interface unverified password change

Summaryinfo

A vulnerability, which was classified as critical, has been found in Netikus EventSentry up to 6.0.1.20. This affects an unknown function of the component Web Reports Interface. The manipulation leads to unverified password change. This vulnerability is listed as CVE-2026-24443. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Netikus EventSentry up to 6.0.1.20. This issue affects an unknown functionality of the component Web Reports Interface. The manipulation with an unknown input leads to a unverified password change vulnerability. Using CWE to declare the problem leads to CWE-620. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.

The weakness was presented by Kazuma Matsumoto. It is possible to read the advisory at eventsentry.com. The identification of this vulnerability is CVE-2026-24443 since 01/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading to version 6.0.1.20 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Netikus

Name

• EventSentry

Version

• 6.0.1.0
• 6.0.1.1
• 6.0.1.2
• 6.0.1.3
• 6.0.1.4
• 6.0.1.5
• 6.0.1.6
• 6.0.1.7
• 6.0.1.8
• 6.0.1.9
• 6.0.1.10
• 6.0.1.11
• 6.0.1.12
• 6.0.1.13
• 6.0.1.14
• 6.0.1.15
• 6.0.1.16
• 6.0.1.17
• 6.0.1.18
• 6.0.1.19
• 6.0.1.20

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion