CVE-2021-39290

Name of the Vulnerable Software and Affected Versions NetModule NB800 versions prior to 4.3.0.113 NetModule NB1600 versions prior to 4.4.0.111 NetModule NB1601 versions prior to 4.4.0.111 NetModule NB1800 versions prior to 4.4.0.111 NetModule NB1810 versions prior to 4.4.0.111 NetModule NB2700 versions prior to 4.5.0.105 NetModule NB2710 versions prior to 4.5.0.105 NetModule NB2800 versions prior to 4.5.0.105 NetModule NB2810 versions prior to 4.5.0.105 NetModule NB3700 versions prior to 4.5.0.105 NetModule NB3701 versions prior to 4.5.0.105 NetModule NB3710 versions prior to 4.5.0.105 NetModule NB3711 versions prior to 4.5.0.105 NetModule NB3720 versions prior to 4.5.0.105 NetModule NB3800 versions prior to 4.5.0.105

Description The issue allows Limited Session Fixation via PHPSESSID. This can affect certain NetModule devices.

Recommendations For NetModule NB800 version prior to 4.3.0.113, update to version 4.3.0.113 or later. For NetModule NB1600, NB1601, NB1800, and NB1810 versions prior to 4.4.0.111, update to version 4.4.0.111 or later. For NetModule NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800 versions prior to 4.5.0.105, update to version 4.5.0.105 or later. As a temporary workaround, consider restricting access to the PHPSESSID session identifier until a patch is available.