CVE-2025-63212
BaseFortify
Publication date: 2025-11-19
Last updated on: 2025-11-21
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gatesair | flexiva-lx | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects GatesAir Flexiva-LX devices on certain firmware versions, where sensitive session identifiers (sids) are exposed in a publicly accessible log file. An attacker who does not need to authenticate can retrieve these session IDs and hijack active sessions, but this requires that the legitimate user had previously closed their browser window without logging out.
How can this vulnerability impact me? :
The vulnerability allows an unauthenticated attacker to hijack sessions by obtaining valid session IDs from a public log file. This can lead to unauthorized access to the device's administrative functions, potentially compromising device security and control.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that users properly log out of the GatesAir Flexiva-LX devices before closing their browser windows to prevent session IDs from being exposed. Additionally, restrict access to the /log/Flexiva%20LX.log file to prevent unauthenticated retrieval of session identifiers. Consider updating or patching the firmware if updates become available that address this issue.