EUVD-2026-89474
GHSA-vq4x-j66h-qfjc
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N), but requires seeding a session ID and victim login (AC:H/UI:R); session takeover grants full account access (C:H/I:H) with no availability effect.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
AnalysisAI
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a chosen session identifier into a victim's browser/client and then reuse that same identifier after the victim logs in, effectively hijacking the authenticated session and gaining the victim's privileges on the fuel-terminal management application. The reported severity is CVSS 7.5 (CVSS v4.0), and the independent assessment rates confidentiality and integrity impact as high with high attack complexity, because success requires both successful session-ID seeding and the victim subsequently authenticating with that identifier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application accept an externally supplied session identifier and fail to regenerate it upon authentication - both are the described defect, present by default in affected TMS7/TopHat versions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a session fixation flaw (CWE-384) in Toptech Systems TMS7/TopHat, an OT petroleum-terminal management platform. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: patch guidance is available through the vendor advisory and the ICS-CERT advisory ICSA-26-272-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02), and Toptech's security communication (https://www.toptech.com/blog/tms7-version-7-8-strengthens-security) references TMS7 7.8 as the security-strengthening release - the exact patched build for TopHat and the minimum safe TMS7 version should be confirmed directly with Toptech before assuming remediation; the released patched version is not independently confirmed from the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Toptech Systems TMS7 and TopHat instances, confirm exposure against ICSA-26-272-02, and restrict management-interface access to trusted OT networks or VPN-only paths while requiring users to re-authenticate and invalidating existing sessions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Session Fixation
View allSession hijacking in self-hosted Zammad 6.3.0 through 6.5.4 allows remote, unauthenticated attackers to take over a legi
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session
Tiny File Manager v2.4.7 and below is vulnerable to session fixation. Rated critical severity (CVSS 9.8), this vulnerabi
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /login
Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. Rated criti
An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to exe
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to ex
Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. Rated critical severity (CVSS 9.8), this vulnerab
Certain NetModule devices allow Limited Session Fixation via PHPSESSID. Rated critical severity (CVSS 9.8), this vulnera
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Rated critical severity (CVSS 9.8), this v
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests be
Same weakness CWE-384 – Session Fixation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today