← Back
CWE-620

88 CVEs • Abstraction: Base

Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

JSON object

Loading...

CVEs (88)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-21935
1Johnsoncontrols
3Metasys Application And Data Server
Metasys Extended Application And Data ServerMetasys Open Application Server
Jun 17, 2026
Jun 15, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.
CVE-2022-21934
1Johnsoncontrols
3Metasys Application And Data Server
Metasys Extended Application And Data ServerMetasys Open Application Server
Jun 17, 2026
May 6, 2022
N/A· v4
8.8 HIGH· v3
6.0 MEDIUM· v2
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions...Show more
Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.Show less
CVE-2021-34786
1Cisco
1Broadworks Commpilot Application Software
Jun 17, 2026
Sep 9, 2021
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.
CVE-2021-34785
1Cisco
1Broadworks Commpilot Application Software
Jun 17, 2026
Sep 9, 2021
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
Multiple vulnerabilities in Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to delete arbitrary user accounts or gain elevated privileges on an affected system.
CVE-2021-22773
1Schneider Electric
6Evlink City Evc1s22p4 Firmware
Evlink City Evc1s7p4 FirmwareEvlink Parking Ev.2 Firmware+3 more
Jun 17, 2026
Jul 21, 2021
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart...Show more
A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker connected to the charging station web server to modify the password of a user.Show less
CVE-2020-7378
1Opencrx
1Opencrx
Jun 17, 2026
Nov 24, 2020
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, inc...Show more
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020.Show less
CVE-2018-8916
1Synology
1Diskstation Manager
Jun 17, 2026
Jun 8, 2018
N/A· v4
8.8 HIGH· v3
4.0 MEDIUM· v2
Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.
CVE-2017-14005
1Prominent
1Multiflex M10a Controller Firmware
May 13, 2026
Oct 17, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An...Show more
An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a user's password, enabling future access and possible configuration changes.Show less