Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Polyeco500_firmware | Sielco | 1.7.0 (including) | 1.7.0 (including) |
| Polyeco500_firmware | Sielco | 10.16 (including) | 10.16 (including) |
Such a scenario is commonly observed when: