CVE-2021-44152

What it actually does

Reprise License Manager 14.2 contains an authentication and authorization bypass in the web administration password-change handler at /goform/change_password_process. The endpoint permits unauthenticated network users to submit password-change requests for existing accounts without proving they are logged in or authorized to manage that account. Successful exploitation lets an attacker take over known accounts, including administrative users if their usernames are known or guessable, resulting in loss of confidentiality, integrity, and availability for the license management interface and potentially for license service operations controlled through that interface.

Why it matters to the business

An attacker who can reach the Reprise License Manager web interface can lock legitimate administrators out and gain control of license management functions. This may disrupt access to licensed engineering, design, scientific, or business applications that depend on the license server, causing operational downtime and user productivity loss. Because exploitation is network-accessible, requires no credentials, has a critical CVSS score, and is assessed as weaponized with a high EPSS probability, exposed instances should be treated as high-priority even though the issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed Reprise License Manager web administration interface, commonly by scanning for RLM web services and fingerprinting the product/version. The attacker then determines or guesses a valid username, such as a default, administrative, or organization-specific account name. Without authenticating, the attacker sends a crafted request directly to /goform/change_password_process with the target username and a new attacker-controlled password. Because the vulnerable handler does not verify the requester’s session or authorization, the password change succeeds. The attacker can then log in as the targeted user, administer the license manager, alter configuration, disrupt license availability, access sensitive licensing data, create persistence where supported by the application, or repeatedly change passwords to deny service to legitimate users.

How to fix it

Upgrade Reprise License Manager to a vendor-supported release that contains the authorization fix for this password-change workflow. No fixed version was provided in the supplied advisory data, so obtain the current patched RLM release directly from Reprise Software or the application vendor that bundles RLM, and verify that the deployed rlm binary/web component is newer than the vulnerable 14.2 release. If immediate upgrade is not possible, restrict network access to the RLM web administration interface to trusted administrative hosts or VPN ranges only, block external access at firewalls/security groups, and place the interface behind strong authentication where supported. Rotate all RLM user passwords after patching or isolating the service, especially administrator accounts, because exploitation changes credentials directly. Review license-server configuration and user lists for unauthorized changes. Disable or limit the web administration interface if it is not operationally required.

How to confirm the fix worked

Confirm the deployed Reprise License Manager version is no longer 14.2 and matches a vendor-supported patched release. Verify the administrative web interface is not reachable from untrusted networks, including the public internet. Attempt to access /goform/change_password_process without an authenticated session in a controlled test; a remediated or mitigated system should reject the request with an authentication or authorization failure and should not change any account password. Review access controls on default RLM web ports, commonly TCP 5054, and confirm only approved management sources can connect. After remediation, confirm legitimate administrators can authenticate, all passwords have been reset, and no unexpected users, license files, options files, or server settings were added or modified.

Typical attack path

1. Scan the internet or internal network for exposed Reprise License Manager web administration services, often on the default RLM web port.
2. Fingerprint the service and identify systems running vulnerable Reprise License Manager 14.2.
3. Identify or guess a valid account name, prioritizing administrative or default-style usernames.
4. Submit an unauthenticated HTTP request to /goform/change_password_process that sets a new password for the chosen account.
5. Authenticate to the web interface using the newly set password.
6. Use the compromised account to administer the license manager, change configuration, disrupt license service availability, or maintain access.
7. Optionally change additional user passwords to expand control or prevent legitimate administrators from recovering access.

How to detect it

Investigate historical web server, RLM web administration, reverse proxy, firewall, VPN, EDR, and network flow logs for access to the vulnerable password-change path. Focus on unauthenticated or unusual requests to /goform/change_password_process, especially from internet addresses, newly observed internal hosts, vulnerability scanners, or addresses that later perform successful logins. Look for sequences where a password-change request is followed by access to administrative pages, license-management functions, service restarts, configuration changes, or failed logins by legitimate users. Review RLM application logs, if enabled, for password-change events, login events, account lockouts, and administrative actions. Examine filesystem timestamps and contents for unexpected changes to RLM configuration files, license files, options files, web configuration, and user/account data. On the host, review process execution, service restart history, shell history, and remote access logs to determine whether web takeover led to broader system activity. Because public threat-actor attribution is not provided, hunt broadly for opportunistic exploitation patterns rather than actor-specific tradecraft.

• /goform/change_password_process
• POST /goform/change_password_process
• GET /goform/change_password_process
• "/goform/change_password_process" 200
• "/goform/change_password_process" 302
• rlm
• rlm.exe
• TCP/5054
• 5054
• change_password_process

What your security team should do

• Immediately inventory all Reprise License Manager deployments, including RLM instances embedded in third-party commercial software products.
• Prioritize any internet-exposed or broadly reachable RLM web interfaces for isolation or upgrade because the vulnerability is unauthenticated, critical, and weaponized.
• Restrict access to the RLM web administration interface at the network layer, allowing only trusted administrative source addresses.
• Upgrade to a vendor-supported patched RLM release or obtain a patched bundled version from the software vendor that ships RLM.
• Rotate all RLM account passwords after applying controls, starting with administrative accounts.
• Review web access logs for unauthenticated requests to /goform/change_password_process and subsequent successful logins from unfamiliar IP addresses.
• Check RLM configuration, user accounts, license files, and options files for unauthorized changes.
• Add SIEM detections for direct requests to the vulnerable password-change endpoint and for successful logins immediately following password-change requests.
• Monitor default RLM web ports, especially TCP 5054, for unexpected exposure or scanning activity.
• If suspicious password changes or unauthorized administration are found, treat the RLM host as potentially compromised and perform incident response, including host triage and credential review.