CVE-2023-28809
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vu…
Published: 2023-06-15 · CVSS: 7.5 · CVSS 3.1
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7