EUVD-2026-79953
GHSA-gq5q-45hh-68cr
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (hq) · only source for this CVE.
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.
AnalysisAI
Predictable web session tokens in Digital Watchdog VMAX A1 G4 DVR, VMAX A1 PLUS, VA1G4/VG4 Recorders and VMAX IP G4 NVR devices allow an attacker positioned on the same network segment to derive valid session identifiers and impersonate authenticated users of the device web interface. The underlying weakness (CWE-337) is a PRNG seeded with insufficient entropy, which bounds the token space to the seed space rather than to a cryptographically large keyspace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today