The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only.
An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi Vantara | Remot Ops Agent | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Disable the password reset feature in the web interface. This vulnerability is addressed in Remote Ops Agent version 2.1.
Workaround
No workaround given by the vendor.
Wed, 14 Oct 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability. | |
| Title | Password Reset Code Accessible in User Listing API | |
| Weaknesses | CWE-640 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: HITVAN
Published:
Updated: 2026-10-14T21:43:08.247Z
Reserved: 2026-10-09T19:44:31.685Z
Link: CVE-2026-108337
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T22:17:22.563
Modified: 2026-10-14T22:17:22.563
Link: CVE-2026-108337
Redhat
No data.
OpenCVE Enrichment
No data.