VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Nov 19, 2025· Updated Jun 17, 2026

CVE-2025-63212

CVE-2025-63212

Description

GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the publicly accessible log file located at /log/Flexiva%20LX.log. An unauthenticated attacker can retrieve valid session IDs and hijack sessions without providing any credentials. This attack requires the legitimate user (admin) to have previously closed the browser window without logging out.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

11
  • GatesAir/LX1000llm-create
    Range: 1.0.13 and 2.0
  • GatesAir/Flexiva-LXllm-fuzzy2 versions
    1.0.13 and 2.0+ 1 more
    • (no CPE)range: 1.0.13 and 2.0
    • (no CPE)
  • GatesAir/Flexiva Lx100 Firmware2 versions
    cpe:2.3:o:gatesair:flexiva_lx100_firmware:1.0.13:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:gatesair:flexiva_lx100_firmware:1.0.13:*:*:*:*:*:*:*
    • cpe:2.3:o:gatesair:flexiva_lx100_firmware:2.0:*:*:*:*:*:*:*
  • GatesAir/Flexiva Lx300 Firmware2 versions
    cpe:2.3:o:gatesair:flexiva_lx300_firmware:1.0.13:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:gatesair:flexiva_lx300_firmware:1.0.13:*:*:*:*:*:*:*
    • cpe:2.3:o:gatesair:flexiva_lx300_firmware:2.0:*:*:*:*:*:*:*
  • GatesAir/Flexiva Lx600 Firmware2 versions
    cpe:2.3:o:gatesair:flexiva_lx600_firmware:1.0.13:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:gatesair:flexiva_lx600_firmware:1.0.13:*:*:*:*:*:*:*
    • cpe:2.3:o:gatesair:flexiva_lx600_firmware:2.0:*:*:*:*:*:*:*
  • GatesAir/Flexiva Lx1000 Firmware2 versions
    cpe:2.3:o:gatesair:flexiva_lx1000_firmware:1.0.13:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:gatesair:flexiva_lx1000_firmware:1.0.13:*:*:*:*:*:*:*
    • cpe:2.3:o:gatesair:flexiva_lx1000_firmware:2.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.