CVE-2024-39275 HIGH

CVE-2024-39275: Advantech ADAM-5630 Use of Persistent Cookies Containing Sensitive Information

Vendor Advantech
Product ADAM-5630
Weakness CWE-539
Published September 27, 2024
Last update September 27, 2024

CVSS base score

8.0/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if the session was terminated, allows an unauthorized attacker to act with the same level of privileges of the legitimate user.

Key dates

02Disclosure timeline

September 27, 2024 CVE published
September 27, 2024 Record updated