CVEvulnerability
CVE-2025-64386
7.7 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2025-10-31
- Last modified
- 2026-06-17
- Assigner
- 50b5080a-775f-442e-83b5-926b5ca517b6
- CVSS 4.0 (50b5080a-775f-442e-83b5-926b5ca517b6)
- 7.7 HIGH — CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-613
Description
The
equipment grants a JWT token for each connection in the timeline, but during an
active valid session, a hijacking of the token can be done. This will allow an
attacker with the token modify parameters of security, access or even steal the
session without
the legitimate and active session detecting it. The web server allows the
attacker to reuse an old session JWT token while the legitimate session is
active.
Related
Weakness · not in database (1)
References
- https://cds.thalesgroup.com/es/s21sec-about cds.thalesgroup.com
- https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./ circutor.com
- https://www.hackrtu.com/blog/cg-0day-en-003/ www.hackrtu.com