Eireann Leverett

The issue concerns a hardcoded serial-console password for a privileged account in the firmware of the affected switches. This might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation where this account is enabled, and leveraging knowledge of this password.

The issue concerns the authentication implementation in the web server, which does not utilize a sufficient source of entropy for generating random numbers. This makes it easier for remote attackers to hijack sessions by predicting a value.