CVE-2015-7924

eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.

Score

CVSS 3.0 8.8 High

Status

Modified - ics-cert@hq.dhs.gov

Published

2015-12-23

Last modified

2024-08-06

Affected products

• Ewon Firmware (Ewon)

References

• http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01
• http://seclists.org/fulldisclosure/2015/Dec/118
• http://www.securityfocus.com/bid/79625
• https://ics-cert.us-cert.gov/advisories/ICSA-15-351-03