The vulnerability allows an authenticated user to change the password for any account without providing the current password, which violates principle of credential validation. This flaw is captured by CWE‑620 and effectively lets an attacker take over a target account after briefly gaining a valid session. The impact includes permanent credential compromise and, if an administrative account is affected, potential escalation of privileges.

This flaw affects the EventSentry product from NETIKUS.NET ltd. Versions prior to 6.0.1.20 are vulnerable, so all installations running earlier builds are impacted.

The severity score of 8.6 indicates a high‑level threat, but the exploitation probability according to EPSS is very low (< 1%). The vulnerability is not currently listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation at this time. The likely attack path involves an attacker who has temporary authenticated access to the system, such as through session hijacking or using a legitimate user’s browser. Once temporary access is secured, the attacker can change the password and lock out the legitimate owner, resulting in persistent account takeover.