VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 13, 2010· Updated Apr 29, 2026

CVE-2009-4509

CVE-2009-4509

Description

The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg/web/lib/secure.php and (2) tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by loading a custom software update, via a crafted "Cookie: tandberg_login=" HTTP header.

Affected products

10
  • Vsecurity/Tandberg Video Communication Server10 versions
    cpe:2.3:a:vsecurity:tandberg_video_communication_server:*:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:*:*:*:*:*:*:*:*range: <=x4.2.1
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x2.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x3.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x3.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vsecurity:tandberg_video_communication_server:x4.2.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.