{"id":"CVE-2025-48461","state":"PUBLISHED","title":"Weak Session Cookie Entropy","description":"Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords.","publishedAt":"2025-06-24T02:02:08.633Z","updatedAt":"2025-06-25T13:23:33.993Z","severity":{"score":5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"CSA"},"assigner":"CSA","products":["Advantech Advantech Wireless Sensing and Equipment (WISE)"],"affected":[{"vendor":"Advantech","product":"Advantech Wireless Sensing and Equipment (WISE)","defaultStatus":"unknown","versions":[{"version":"A2.01 B00","status":"affected"}]}],"references":["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061/"],"weaknesses":["CWE-341"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/48xxx/CVE-2025-48461.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-48461","state":"PUBLISHED","datePublished":"2025-06-24T02:02:08.633Z","dateUpdated":"2025-06-25T13:23:33.993Z","assignerShortName":"CSA","assignerOrgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateReserved":"2025-05-22T09:41:25.401Z"},"containers":{"cna":{"title":"Weak Session Cookie Entropy","descriptions":[{"lang":"en","value":"Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords."}],"affected":[{"vendor":"Advantech","product":"Advantech Wireless Sensing and Equipment (WISE)","defaultStatus":"unknown","versions":[{"version":"A2.01 B00","status":"affected"}]}],"references":[{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"shortName":"CSA","orgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateUpdated":"2025-06-24T02:33:00.989Z"},"credits":[{"lang":"en","type":"finder","value":"Joel Chang Zhi Kai"}],"datePublic":"2025-06-24T02:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"This vulnerability can be mitigated by enabling the Security Mode, an existing configuration feature available in previous firmware versions. Security Mode restricts access to unsecured web interfaces and disables unnecessary services to reduce attack surfaces. Users and administrators of affected products are strongly advised to enable Security Mode immediately after configuration.\n\n<br>"}],"value":"This vulnerability can be mitigated by enabling the Security Mode, an existing configuration feature available in previous firmware versions. Security Mode restricts access to unsecured web interfaces and disables unnecessary services to reduce attack surfaces. Users and administrators of affected products are strongly advised to enable Security Mode immediately after configuration."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-24T16:45:36.031567Z","id":"CVE-2025-48461","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-341","type":"CWE","lang":"en","description":"CWE-341 Predictable from Observable State"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-25T13:23:33.993Z"}}]}}}