Integrics Enswitch: Authentication bypass in password reset API
Summary
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass in the password update API endpoint /api/json/user/password/update/. If the reset parameter is omitted, an unauthenticated attacker who knows a username can set a new password for accounts without a pending password reset, including administrator accounts. The endpoint also reveals whether a username exists. Enable Security reports exploitation in the wild before public disclosure.
Affected
- Integrics Enswitch 3.13 through 4.4
- Enable Security confirmed the vulnerability on Enswitch 4.2; other branches were not independently tested
Fixed in
- Enswitch 3.13 to 4.3: Subversion revision 21680 or later
- Enswitch 4.4: Git commit c2c981578 or later
Workaround
- Restrict access to /api/json/user/password/update/ to trusted clients, or block the path at the edge, until the fix is installed.
Exploitation
- Enable Security reports exploitation in the wild before public disclosure; this was not independently verified.
- CISA SSVC: Exploitation PoC, Automatable yes, Technical Impact total.
- No CISA KEV entry was found in the research.
Our recommendation
- Inventory all Enswitch instances and their exact builds.
- Apply the vendor fix from Integrics without delay and confirm the build with Integrics.
- Block or restrict the password update endpoint until the patch is installed.
- Review password-change and login logs since July 2026 for unexpected resets and unknown administrator accounts, and rotate administrator credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Enable Security advisory ES2026-06 www.enablesecurity.com
- VulnCheck advisory www.vulncheck.com
- Enable Security blog: Enswitch password reset bypass www.enablesecurity.com
- Integrics Enswitch product page www.integrics.com
- VulDB entry vuldb.com
- Vulners entry vulners.com
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:00.
Original description (NVD)
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.