CVE-2025-63212: Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 32% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Enforce strict session management policies: ensure that administrators always log out explicitly to invalidate sessions rather than just closing browser windows.
- Restrict access to log files: configure device or network controls to prevent unauthenticated access to /log/Flexiva%20LX.log and other sensitive files.
- Implement network segmentation: isolate broadcast device management interfaces from general network access, limiting exposure to trusted administrators only.
- Monitor logs and access patterns for unusual retrieval of session files or repeated access attempts.
- Apply firmware updates or patches as soon as they become available from GatesAir addressing this vulnerability.
- Consider deploying web application firewalls or intrusion detection systems to detect and block attempts to access sensitive log files.
- Educate administrators on secure session handling and the risks of leaving sessions active.
- If possible, disable or restrict logging of session identifiers in logs to prevent exposure.
- Use multi-factor authentication on administrative interfaces to reduce risk even if session IDs are compromised.
Description
GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the publicly accessible log file located at /log/Flexiva%20LX.log. An unauthenticated attacker can retrieve valid session IDs and hijack sessions without providing any credentials. This attack requires the legitimate user (admin) to have previously closed the browser window without logging out.