CVE-2024-44575 RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

LowCVSS 3.7 EPSS 0.25%

Published: 2024-09-11 03:27 (approximate time: when CVE Radar first recorded it)
Updated: 2026-07-05 04:20
Exploit status: No public exploit known

Description

RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.

Affected products

Product	Affected versions	Fixed in
relyum rely-pcie firmware	>= 22.2.1, <= 23.1.0	No fix listed

References

www.relyum.com broken-link

CVSS v3.1

3.7 Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.25% (percentile 17.1)
CWE: CWE-732 Incorrect Permission Assignment for Critical Resource

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.