Nexterm
Monthly
Nexterm through 1.2.2-BETA fails to verify session ownership on its session lifecycle routes, letting any authenticated user hibernate, resume, or terminate another user's live SSH, RDP, VNC, or SFTP session if they know or obtain the target session ID. This is an authorization/IDOR flaw (CWE-639) rated moderate severity: it requires a valid low-privilege account plus a target session identifier, and the outcome is limited to disruption of in-progress sessions with no read access to the victim's data. No public exploit code has been confirmed at time of analysis, and the vendor has addressed the issue in a patched release that enforces ownership validation.
Nexterm through 1.2.2-BETA fails to verify session ownership on its session lifecycle routes, letting any authenticated user hibernate, resume, or terminate another user's live SSH, RDP, VNC, or SFTP session if they know or obtain the target session ID. This is an authorization/IDOR flaw (CWE-639) rated moderate severity: it requires a valid low-privilege account plus a target session identifier, and the outcome is limited to disruption of in-progress sessions with no read access to the victim's data. No public exploit code has been confirmed at time of analysis, and the vendor has addressed the issue in a patched release that enforces ownership validation.