Login Request a demo
Medium severity · published May 19, 2025
CVE-2025-28371
EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Enh500 Firmware · Engeniustech
3.7.22 · source: NVD
Affected product
EF
Enh500 Firmware
Engeniustech
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-28371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-28371
Exploit
https://drive.google.com/file/d/1kQFOyFQYycKynIBjbU8bMx2gYTG3Bxi2/view?usp=sharing
Third Party Advisory
https://pastebin.com/raw/EnL1XT2n
Third Party Advisory
https://pastebin.com/raw/hziq1nGH