The Mennekes Amtron series firmware up to version 5.22.3 contains an authentication bypass that permits an unauthenticated remote attacker to change a user account password by sending a specially crafted POST request to the /operator/operator endpoint. This flaw enables the attacker to gain unauthorized control over the device, effectively elevating privileges without proper authentication. The weakness is a classic authorization flaw identified by CWE-287 and can compromise confidentiality, integrity, and future authentication mechanisms.

Mennekes Amtron series devices running firmware versions 5.22.3 or earlier.

The CVSS score of 9.3 classifies the vulnerability as Critical, indicating a severe impact if successfully exploited. Although EPSS data is unavailable, the lack of a KEV listing suggests no known public exploits have been documented as of the current assessment. An attacker can reach the vulnerable endpoint by sending an HTTP POST request to the device’s /operator/operator path, which may be exposed over internal or public networks. The vulnerability requires no local privileged user or cached credentials, making the attack vector remote and straightforward once network access exists.