CVE-2017-14007

An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's session is available for an extended period beyond the last activity, allowing an attacker to reuse an old session for authorization.

Score

CVSS 3.0 5.6 Medium

Status

Modified - ics-cert@hq.dhs.gov

Published

2017-10-17

Last modified

2024-08-05

Weaknesses

CWE-613

Affected products

• Multiflex M10a Controller Firmware (Prominent)

References

• http://www.securityfocus.com/bid/101259
• https://ics-cert.us-cert.gov/advisories/ICSA-17-285-01