Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108337— Password Reset Code Accessible in User Listing API

Quick assessment

Affected
Hitachi Vantara Remot Ops Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

管理员可以检索任意用户的密码重置码，并接管这些账户。 密码重置码被包含在某个 API 的返回数据中，攻击者可以利用这些代码重置任何账户的密码。该 API 仅限管理员账户访问。 已具备应用程序管理员权限的攻击者，可以利用此漏洞窃取应用中其他账户的凭证。不过，此漏洞无法用于访问设备凭据或客户数据。

CVSS 7.4 · High EPSS 0.28% · P19

Possible ATT&CK Techniques 1 AI

T1528 · Steal Application Access Token

Affected Version Matrix 2

VendorProduct Version RangeStatus
Hitachi Vantara Remot Ops Agent 2.1 unaffected
1.6.0≤ 2.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108337

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Password Reset Code Accessible in User Listing API
Source: CVE Program / CVE List V5
Vulnerability Description
An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Hitachi Vantara Remot Ops Agent 1.6.0 ~ 2.0 -

II. Public POCs for CVE-2026-108337

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108337

请登录查看更多情报信息。

Other References for CVE-2026-108337 (1)

Same Patch Batch · Hitachi Vantara · 2026-10-14 · 3 CVEs total

CVE-2026-108336 9.1 CRITICAL Token Signing Key Allows Unauthenticated Administrative Access
CVE-2026-108335 9.1 CRITICAL Password Reset Functionality Missing Brute-Force Protection

IV. Related Vulnerabilities

Same product: Remot Ops Agent
Same vendor: Hitachi Vantara
Same weakness: CWE-640

V. Comments for CVE-2026-108337

No comments yet

Leave a comment