CVE-2026-24443 - Vulnerability Analysis

Overview

EventSentry < 6.0.1.20 contains a broken authentication vulnerability caused by lack of current password validation in the Web Reports account management, letting attackers with temporary authenticated sessions change passwords and escalate privileges.

Severity & Score

Impact

Attackers with temporary authenticated sessions can change passwords, enabling persistent account takeover and potential privilege escalation.

Mitigation

Update to version 6.0.1.20 or later.

References

• https://www.eventsentry.com/downloads/version-history
• https://www.vulncheck.com/advisories/eventsentry-web-reports-unverified-password-change

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🟠 CVE-2026-24443 - High (8.8) EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password bef... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24443/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner