The user listing API that is restricted to administrative accounts exposes password reset codes for every user in its output. An attacker who already holds administrator privileges can capture these codes and issue a password reset for any target account, effectively assuming control of that account. The flaw belongs to CWE‑640, involving disclosure of sensitive authentication data.

Hitachi Vantara’s Remote Ops Agent is affected by this issue in all releases prior to version 2.1. The documented remediation is to disable the password reset functionality in the web interface or to upgrade the agent to version 2.1 or later, where the API no longer returns the reset codes.

With a CVSS base score of 7.4, this vulnerability poses a high risk when administrative credentials are compromised, but it does not leak device credentials or customer data. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, which suggests a currently low exploitation probability yet still warrants timely patching or mitigation. Exploitation requires admin access, so the attack surface is limited to compromised or weak admin credentials.