CVE-2015-2804 The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers...
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alcatel-lucent omniswitch firmware | <= 6.4.5.r02 | No fix listed |
| alcatel-lucent omniswitch firmware | <= 6.4.6.r01 | No fix listed |
| alcatel-lucent omniswitch firmware | <= 6.6.4.r01 | No fix listed |
| alcatel-lucent omniswitch firmware | <= 6.6.5.r02 | No fix listed |
References
- packetstormsecurity.com exploit
- 20150610 [RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session ID exploit mailing-list
- 20150610 [RT-SA-2015-003] Alcatel-Lucent OmniSwitch Web Interface Weak Session ID mailing-list
- 75125 vdb-entry
- www.redteam-pentesting.de exploit