CVE-2017-15304

2022-10-0316:23:34

mitre

www.cve.org

cve-2017-15304

session hijacking

persistent access

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a “Cookie: PHPSESSID=” header. This can be used to achieve persistent access to the admin panel even after an admin password change.