CVE-2025-63226: Insufficient Session Expiration
Source CVE Database V5
Not known to be exploited · CVSS 5.7 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 18 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-63226, European organizations should implement the following specific measures: 1) Enforce strict network segmentation to isolate SMP100 devices from general user networks, limiting attacker access to the same network segment. 2) Deploy robust monitoring and alerting for any unauthorized user additions or unusual activity on the SMP100 platform. 3) Implement strict session timeout policies and ensure sessions are invalidated promptly after logout or inactivity to reduce session hijacking windows. 4) Use network-level access controls such as VLANs and firewall rules to restrict access to the /UserManagement.html endpoint only to trusted administrators. 5) Employ multi-factor authentication (MFA) at the network or device management layer if possible to add an additional security barrier. 6) Regularly audit user accounts on the SMP100 platform to detect and remove unauthorized users. 7) Coordinate with Sencore for timely patch deployment once available and maintain firmware updates as part of routine security hygiene. 8) Educate network administrators about the risks of session hijacking and the importance of secure session management practices. These targeted actions go beyond generic advice by focusing on network architecture and operational controls tailored to the SMP100 environment.
Description
The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking due to improper session management on the /UserManagement.html endpoint. Attackers who are on the same network as the victim and have access to the target's logged-in session can access the endpoint and add new users without any authentication. This allows attackers to gain unauthorized access to the system and perform malicious activities.