/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" header. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP
Information Disclosure
Session Fixation
Hdmi Dongle Firmware
NVD
CVSS 3.0
9.8
EPSS
0.3%