CVE-2026-24443 describes an unverified password change vulnerability (CWE-620) in NETIKUS.NET ltd's EventSentry product prior to version 6.0.1.20. The vulnerability exists in the account management functionality of the Web Reports interface, where the system fails to require validation of the current password before allowing a new password to be set. This flaw allows an attacker who gains temporary access to an authenticated user session to change the account password without knowledge of the original credentials. If administrative accounts are affected, this can result in privilege escalation.

An attacker with temporary access to an authenticated session can change the password of that account without knowing the original password. This enables persistent account takeover. If the compromised account has administrative privileges, the attacker may escalate privileges, potentially gaining full control over the system. There are no known exploits in the wild at this time.

A fixed version 6.0.1.20 or later is implied but not explicitly confirmed in the provided data. Since no patch links or vendor advisory are provided, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, restrict access to authenticated sessions and monitor for unauthorized password changes. Avoid sharing authenticated sessions and consider additional session security controls.