Re6250
Monthly
Predictable session identifiers in the Linksys RE6250 Web Management Interface (firmware 1.0.04.001) can expose session-scoped information because session_id values are generated with insufficient randomness and checked with strcmp. A remote, unauthenticated attacker could exploit this only by successfully predicting a valid token, a high-complexity condition; publicly available exploit code exists, and the impact is limited to low confidentiality with no integrity or availability effect (CVSS 4.0 base 6.3; assessed CVSS 3.1 C:L/I:N/A:N).
Predictable session identifiers in the Linksys RE6250 Web Management Interface (firmware 1.0.04.001) can expose session-scoped information because session_id values are generated with insufficient randomness and checked with strcmp. A remote, unauthenticated attacker could exploit this only by successfully predicting a valid token, a high-complexity condition; publicly available exploit code exists, and the impact is limited to low confidentiality with no integrity or availability effect (CVSS 4.0 base 6.3; assessed CVSS 3.1 C:L/I:N/A:N).