CVE-2021-28293

9.8 criticalEPSS 1.6%

Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password reset functionality, and thus an unauthenticated attacker can set an arbitrary password for any user.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-640
Published: 2021-06-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

seceon:aisiem

References

https://0xdb9.in/2021/06/07/cve-2021-28293.html
https://www.seceon.com/advanced-siem-aisiem
https://0xdb9.in/2021/06/07/cve-2021-28293.html
https://www.seceon.com/advanced-siem-aisiem

Check your stack JSON