Threats tagged 'ghsa-qrpj-fx7w-27q9'

Tenda AC15 router firmware version 15.03.05.18_multi issues an authentication cookie that exposes the account password hash to the client. The session identifier uses a short, low-entropy suffix, making it vulnerable to theft and replay attacks by an attacker with network access or the ability to execute JavaScript in the victim's browser.