CVE-2015-2804
- State
- Published
- Severity
- Not scored
- Published
- Jun 16, 2015
- Updated
- Aug 6, 2024
- Reserved
- Mar 30, 2015
Description
The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2015-003/-alcatel-lucent-omniswitch-web-interface-weak-session-id
- 20150610 [RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session IDmailing-list
- 20150610 [RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session IDmailing-list
- http://packetstormsecurity.com/files/132235/Alcatel-Lucent-OmniSwitch-Web-Interface-Weak-Session-ID.html
- 75125vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.