EUVD-2026-78410
GHSA-w3pv-wmxm-rj3j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Web UI is network-reachable and needs no attacker credentials, but the victim must authenticate through the attacker's session ID (UI:R); high confidentiality and integrity impact.
Primary rating from Vendor (Secomea).
CVSS VectorVendor: Secomea
Lifecycle Timeline
2DescriptionCVE.org
Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.
This issue affects GateManager: 11.5;0, 11.4.625515072:0.
Fixed in Version 11.6 or 11.4.626194074 and above
AnalysisAI
Session fixation in the Secomea GateManager webserver module lets an attacker who can plant a known session identifier on a victim's browser inherit that victim's authenticated session once they log in, yielding full control of the appliance's administrative web interface. Affected builds are GateManager 11.5 and 11.4.625515072; the vendor has released fixes in 11.6 and 11.4.626194074 and above. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete things in combination: (1) the GateManager webserver module must be reachable by the attacker (the CVSS AV:N metric confirms a network path, and the session-fixation primitive hinges on the attacker being able to plant or observe a session identifier); (2) a victim with valid GateManager credentials must then authenticate using the attacker-supplied session ID, which is the UI:R requirement and the single biggest limiting factor - an unattended appliance cannot be compromised by this technique alone; and (3) the deployment must be running an affected build, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L describes a network-reachable flaw that needs no credentials but does depend on a victim completing a login (UI:R), with high confidentiality and integrity impact and a partial availability impact - a realistic recipe for full administrative takeover of a remote-access appliance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GateManager to version 11.6 or to 11.4.626194074 (or later within that maintenance train) as the primary fix, since the vendor has explicitly identified those as containing the session-regeneration correction; confirm the target build number after upgrade rather than assuming the newest download is patched. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." s
Same weakness CWE-384 – Session Fixation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today