CVE-2025-28371

EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function

Medium · published May 19, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.6th percentile
Published
2025-05-19T00:00Z
EPSS history
Timeline
  • 19 MAY 00:00Z
    EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function
    cvelistv5