This vulnerability in Microchip IStaX involves insufficient entropy in the generation of a shared per-device cookie secret used in webstax_auth session cookies. An authenticated user with low privileges can recover this secret from their own session cookie and use it to forge a cookie that grants administrative privileges, effectively escalating their access rights. The issue affects versions prior to 2026.03. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring privileges but no user interaction.

An attacker with low-level authenticated access can escalate privileges to administrative level by forging authentication cookies. This compromises the integrity and confidentiality of the system and may allow full administrative control over the affected Microchip IStaX device or service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict low-privileged user access and monitor for suspicious cookie manipulation activities if possible.