CVE-2025-70973: Medium severity ScadaBR ScadaBR vulnerability
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. As a result, a session created prior to login becomes authenticated once the victim logs in, allowing an attacker who knows the session ID to hijack an authenticated session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-70973?
CVE-2025-70973 has a medium severity level due to its potential to allow session fixation attacks.
How do I fix CVE-2025-70973?
To fix CVE-2025-70973, ensure that your application regenerates the session identifier after a user successfully authenticates.
Who is affected by CVE-2025-70973?
CVE-2025-70973 affects users of ScadaBR version 1.12.4 and earlier who do not implement session management correctly.
What type of vulnerability is CVE-2025-70973?
CVE-2025-70973 is classified as a session fixation vulnerability, which can lead to unauthorized access.
What are the consequences of not addressing CVE-2025-70973?
Failing to address CVE-2025-70973 may allow attackers to hijack authenticated user sessions, compromising user accounts.