CVE-2024-47945
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Oct 15, 2024
Updated: Oct 21, 2024
CWE ID 340
CWE ID 331
Summary
CVE-2024-47945 is a session hijacking vulnerability affecting certain devices. The issue stems from insufficient entropy in the session ID generation algorithm, leading to only 32,768 possible values per user. This predictability makes it easy for attackers to pre-generate valid session IDs, resulting in unauthorized access to user sessions. The vulnerability is not only due to the use of an insecure rand() function call but also because of missing initialization via srand(), causing only Process IDs (PIDs) to be used as seeds.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- RITTAL CORP