CVE-2021-41716

CriticalCVSS 9.8

Published: 07/12/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.31%

67th percentile - higher than 67% of all known CVEs

Summary

The Maharashtra State Electricity Board Mahavitara Android application version 8.20 and prior is vulnerable to remote account takeover due to an OTP fixation vulnerability in the password reset function.

Risk Assessment

An attacker can remotely take over a user account, gaining unauthorized access to sensitive data and application functions, potentially leading to identity theft or data manipulation.

Recommendation

Immediately update the application to the latest available version and implement mechanisms for random OTP generation and binding to the user session.

Original NVD description (English source)

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function