The password change function at /cgi/admin.cgi does not require the current password, allowing an attacker to change a user's password without knowing the old one. This vulnerability enables account takeover by exploiting the password reset parameter, potentially combined with a CSRF attack.