Change password function does not require

Change password function does not require re-authentication for admin user in BroadWorks

On the BroadWorks R22 platform, the administrator password can be changed without having to verify the old password. This was flagged as a security risk by the security vendor (EY) during a security audit on the BroadWorks' XSP server.

EY can only lower this issue to Low, considering that there is 2FA for the initial access and only accessible via secure VPN. Can Cisco/BroadSofat consider the old password in the change of password for administrator via the XSP's web portal?