CVE-2020-7378
9.1
CRITICAL · CVSS 3.1 · EPSS 2.6% (pctl 85)
In your normal cycle
Critical by CVSS (9.1), but no sign of active exploitation.
Description
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020.
Scoring
| CVSS | 9.1 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 2.62% — more likely to be exploited than 85% of all CVEs |
| Weakness | CWE-620 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-11-24 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| opencrx | opencrx |
References
→ the Explorer · watch your stack · NVD