There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi Vantara | Remote Ops Agent | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
This vulnerability is addressed in Remote Ops Agent version 2.1. Migration is recommended.
Workaround
No workaround given by the vendor.
Wed, 14 Oct 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability. | |
| Title | Password Reset Functionality Missing Brute-Force Protection | |
| Weaknesses | CWE-640 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: HITVAN
Published:
Updated: 2026-10-14T21:39:17.470Z
Reserved: 2026-10-09T19:44:28.337Z
Link: CVE-2026-108335
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T22:17:22.290
Modified: 2026-10-14T22:17:22.290
Link: CVE-2026-108335
Redhat
No data.
OpenCVE Enrichment
No data.