Siemens Mendix Forgot Password Module

An attacker could enumerate valid usernames in Siemens Mendix applications, allowing them to identify real accounts for targeted social engineering or credential attacks. This could enable unauthorized access to engineering and administrative functions in industrial control systems.

This affects water authorities and utilities using Siemens Mendix for engineering workstations, SCADA human-machine interfaces (HMIs), or administrative portals. If these applications manage control logic or process monitoring, unauthorized access could lead to operational disruptions. Primarily impacts IT staff, engineers, and system administrators who rely on these platforms for industrial control system management.

An attacker sends password reset requests to the Mendix Forgot Password module and observes the response behavior (timing, error messages, or page content differences) to determine which usernames exist in the system. Once valid usernames are identified, the attacker could target those accounts with credential stuffing, phishing, or brute force attacks to gain access to engineering workstations or administrative interfaces.