CVE-2025-28371 Auth bypass in n/a
Attackers can bypass authentication and change the administrator password on EnGenius access points without knowing the current password.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-28371?
CVE-2025-28371 is a medium-severity authentication bypass vulnerability in n/a, published on 19 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password.
Weakness: CWE-284
Which versions are affected by CVE-2025-28371?
It affects 1 product.
Products include Engeniustech Enh500 Firmware.
How do I fix CVE-2025-28371?
No fix has been published for CVE-2025-28371 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-28371 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-28371 exists.
Sources
Also known as GHSA-8p9j-879p-799j.