Technical Advisory – ICTFAX 7-4 – Indirect Object Reference

This advisory describes an insecure direct object reference in ICTFax that allows an authenticated low-privilege user to reset any user's password (including administrators) by altering a numeric user identifier in the password-change request; the report includes reproduction steps, impact assessment, a recommendation to require current password re-entry, and a vendor disclosure timeline.