CVE-2025-64386
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
31/10/2025
Last modified:
04/11/2025
Description
The<br />
equipment grants a JWT token for each connection in the timeline, but during an<br />
active valid session, a hijacking of the token can be done. This will allow an<br />
attacker with the token modify parameters of security, access or even steal the<br />
session without<br />
the legitimate and active session detecting it. The web server allows the<br />
attacker to reuse an old session JWT token while the legitimate session is<br />
active.
Impact
Base Score 4.0
7.70
Severity 4.0
HIGH