Session Hijacking Vulnerability in Cisco Integrated Management Controller

CVE-2017-6617

What is CVE-2017-6617?

A vulnerability in the session management of the Cisco Integrated Management Controller (IMC) web-based GUI could allow an unauthenticated attacker to hijack valid user sessions. This issue arises because the system fails to generate a new session identifier after a user logs in. By exploiting this flaw, attackers can use a compromised session identifier to gain unauthorized access to the software. A successful exploitation could enable them to control the session of an authenticated user, jeopardizing the integrity and security of the user's access.

References