CVE-2021-22661

Name of the Vulnerable Software and Affected Versions ICX35-HWC-A versions 1.9.62 and prior ICX35-HWC-E versions 1.9.62 and prior

Description The issue allows the password to be changed without requiring the current password, potentially enabling unauthorized changes by users or external processes. This is due to the lack of a requirement to enter the current password when changing it on the module webpage.

Recommendations For versions 1.9.62 and prior of ICX35-HWC-A and ICX35-HWC-E, consider implementing a workaround that requires the current password to be entered before changing it, or restrict access to the password change functionality until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.