Medium severity4.8NVD Advisory· Published Mar 9, 2026· Updated Apr 7, 2026
CVE-2025-70973
CVE-2025-70973
Description
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. As a result, a session created prior to login becomes authenticated once the victim logs in, allowing an attacker who knows the session ID to hijack an authenticated session.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/chiranjib2001/ScadaBR/blob/main/README.mdnvdExploitMailing ListThird Party Advisory
News mentions
0No linked articles in our index yet.