Insecure HTTP Session Management in Cisco Network Building Mediator Products

CVE-2010-0598

Summary

The Cisco Network Building Mediator products have a security weakness in their handling of HTTP sessions; they do not encrypt sessions generated from operator workstations. This flaw exposes sensitive Administrator credentials by making it possible for remote attackers to sniff unprotected network traffic. The issue affects multiple versions of the Cisco Mediator Framework and specific models of the Cisco Network Building Mediator, creating significant risk for organizations relying on these systems. Proper encryption strategies are essential to safeguard administrative login information and mitigate potential unauthorized access.

References