CVE-2025-0479

Katalog CVE

CVSS 8.6 · High EPSS 0,44%

Kerentanan Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. Skor CVSS 4.0 8.6 (High) menurut cert-in.org.in.

Deskripsi (NVD)

This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.

Rincian

Terbit di NVD

20 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

8.6 (High), sumber cert-in.org.in
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0005