CVE-2024-26520

Published: Jul 26, 2024Modified: Jun 17, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets.

Related CWEs

CWE-620

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

References (2)

https://idssgmcc.github.io/aran.github.io/2.html

Source: cve@mitre.org

https://idssgmcc.github.io/aran.github.io/2.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.