EnGenius ENH500 AP 2T2R Incorrect Access Control Vulnerability in Password Change Function

A vulnerability has been identified in the EnGenius ENH500 AP 2T2R access point, specifically in version 3.7.22 of the firmware. The issue arises from incorrect access control in the password change function, where the device does not properly validate the current password. This flaw enables an attacker to send a password change request with an invalid current password, effectively allowing unauthorized password resets and potential takeover of the device.

Impact

Exploitation of this vulnerability could lead to unauthorized password changes, allowing an attacker to gain control over the affected device.