ITEL ISO FM SFN Adapter Session Hijacking Vulnerability (CVE-2025-63219)

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2025-63219 Vulnerability Type: Session Hijacking Affected Product: ITEL ISO FM SFN Adapter Affected Versions: - WebServer: 2.0 - Firmware: ISO2 2.0.0.0 Vulnerability Description The ITEL ISO FM SFN Adapter (firmware version: ISO2 2.0.0.0, WebServer version: 2.0) has improper session management at the endpoint, allowing unauthorized users to access active sessions and thereby gain control over the device, modify configurations, and compromise system integrity. Impact Severity: High Description: - Attackers can access active sessions via the endpoint without authentication. - If an authenticated user has an active session, attackers can automatically gain system access. - This may lead to unauthorized device control, modification of system settings, and potential service disruption. Attack Vector Access Method: Direct navigation to Authentication Required: None (attackers do not need to log in) Exploit Complexity: Very Low Vulnerability Type Information Type: Session Hijacking / Access Control Bypass CWE-ID: - CWE-384 - Session Fixation - CWE-306 - Missing Authentication for Critical Function Definition: The endpoint does not enforce authentication, allowing unauthorized access to active sessions without verification. Discoverer Mohamed Shahat Recommended Remediation 1. Implement proper session management: Require authentication before accessing . 2. Use secure session cookies: Configure session expiration and secure cookies to prevent unauthorized access. 3. Enforce Role-Based Access Control (RBAC): Restrict access to authenticated users only. Mitigation and Workarounds Until a patch is released, administrators should: Restrict access to using firewall rules or web server configuration. Enable forced logout after session timeout. Manually monitor active sessions and clear unauthorized logins.

Goal Reached Thanks to every supporter — we hit 100%!

ITEL ISO FM SFN Adapter Session Hijacking Vulnerability (CVE-2025-63219)

More from this source