Nexterm CVE-2026-120200

Requires an authenticated low-privilege Nexterm account (PR:L) AND possession of another user's valid session ID; with those, the attacker invokes the session lifecycle routes in server/routes/serverSession.js - GET /:id (hibernate), POST /:id/resume, and the DELETE connection endpoint - which, before the fix, did not call validateSessionOwnership(). The primary limiting factors are the need for valid authentication and the need to obtain or guess a target session ID; the impact is confined to disrupting other users' in-progress SSH, RDP, VNC, or SFTP sessions, with no read access to their data. Affected: Nexterm through 1.2.2-BETA; the only complete fix is upgrading to the patched version that enforces ownership validation.

This is a genuine but moderate-severity issue, best characterized as an authorization/IDOR flaw (CWE-639) rather than a critical one. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) tells a consistent story: network-reachable and low-complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only low integrity and availability impact with no confidentiality loss (VC:N). The score of 5.3 is congruent with the described effect - disruption of other users' live sessions, not data theft or code execution. No EPSS probability, CISA KEV entry, or SSVC automatable/technical-impact data was supplied, and the references contain an issue, a fix PR, and the vulnerable-line pointer but no exploit code, so there is no public exploit identified at time of analysis. The vendor-aligned priority label is 'this_month', which is consistent with a non-emergency authenticated denial/disruption bug. The one caveat worth verifying: the description states the attacker must 'obtain a session ID', which the CVSS vector treats as no added attack requirement (AT:N/AC:L) - if session IDs are not easily enumerable or discoverable, real-world exploitability is lower than the network vector alone implies. Overall this is a legitimate fix-in-normal-cycle item, not a drop-everything priority.

A low-privilege but authenticated Nexterm user obtains another user's active session ID and sends a request to the hibernate, resume, or DELETE connection endpoint under /server-session routes. Because the lifecycle handlers did not verify session ownership, the call succeeds against the victim's session, abruptly hibernating or tearing down their live SSH, RDP, VNC, or SFTP connection. No public exploit code was identified in the provided sources, though the patch diff publicly reveals the exact vulnerable handlers.