There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge.
An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Hitachi Vantara | Remote Ops Agent | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
This vulnerability is addressed in Remote Ops Agent version 2.1. Migration is recommended.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability. | |
| Title | Password Reset Functionality Missing Brute-Force Protection | |
| Weaknesses | CWE-640 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: HITVAN
Published:
Updated: 2026-10-14T21:39:17.470Z
Reserved: 2026-10-09T19:44:28.337Z
Link: CVE-2026-108335
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.