CVE-2015-2804: Infoleak
The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2804?
CVE-2015-2804 is classified as a high severity vulnerability due to the risk of session hijacking.
How do I fix CVE-2015-2804?
To fix CVE-2015-2804, update the Alcatel-Lucent OmniSwitch firmware to versions 6.6.4.309.R01 or 6.6.5.80.R02 or later.
What devices are affected by CVE-2015-2804?
CVE-2015-2804 affects Alcatel-Lucent OmniSwitch models 6450, 6250, 6850E, 9000E, 6400, and 6855 with vulnerable firmware versions.
What type of attack can exploit CVE-2015-2804?
CVE-2015-2804 can be exploited through a brute force attack to hijack session identifiers.
Is CVE-2015-2804 a remote vulnerability?
Yes, CVE-2015-2804 allows remote attackers to exploit the vulnerability without physical access to the device.