CVE-2022-24551: Starwindsoftware NAS

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any local user password (including system/administrator user) using any available user This affects StarWind SAN and NAS v0.2 build 1633.

Affected products

• Starwindsoftware NAS: before 0.2 (fixed in 0.2)
• Starwindsoftware San: before 0.2 (fixed in 0.2)

Published 2022-02-06. Last modified 2026-06-17.