CVE-2021-44152: Reprise License Manager unauthenticated password change

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-accessible account takeover with a CVSS score of 9.8 and high EPSS probability.

What it is

Reprise RLM 14.2 exposes /goform/change_password_process without any authentication or authorization check. An unauthenticated attacker can set a new password for any known user account, locking out the legitimate user and taking over the account. The flaw is a missing authentication control on a critical function, rated CVSS 9.8 critical.

Impact

An attacker gains full access to any targeted user account and can lock legitimate users out of the system. Depending on the privileges of the targeted account, this can lead to complete compromise of the license manager.

Attack surface

Reachable over the network via HTTP requests to /goform/change_password_process; the CVSS vector shows no privileges and no user interaction required. The only prerequisite is knowing a valid username.

Exploitation

Not listed in CISA KEV, but EPSS is 0.58555 (99th percentile) and public exploit code is referenced on Packet Storm, indicating active interest and easy exploitation.

What to do

• Apply the vendor patch or upgrade from RLM 14.2 to the latest available release.
• Restrict network access to the RLM administrative interface to trusted hosts only.
• Change all RLM account passwords after patching and review accounts for unauthorized changes.
• Monitor and alert on requests to /goform/change_password_process from untrusted sources.

Detection

• Alert on POST requests to /goform/change_password_process, especially from external or unexpected source IPs.
• Monitor authentication logs for password changes on RLM accounts outside normal administrative activity.
• Watch for repeated failed logins by legitimate users, which may indicate their passwords were changed by an attacker.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.