CVE-2017-10890: sharp corporation rx-clv1-p firmware Session Fixation

Vulnerability summary

CVE-2017-10890 is a medium (CVSS 4.6) Session Fixation vulnerability in sharp corporation rx-clv1-p firmware. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35% of scored vulnerabilities.

Timeline

1. 17-11-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Session management issue in RX-V200 firmware versions prior to 09.87.17.09, RX-V100 firmware versions prior to 03.29.17.09, RX-CLV1-P firmware versions prior to 79.17.17.09, RX-CLV2-B firmware versions prior to 89.07.17.09, RX-CLV3-N firmware versions prior to 91.09.17.10 allows an attacker on the same LAN to perform arbitrary operations or access information via unspecified vectors.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.