| Title | Linksys RE6250 v1.0.04.001 Use of Insufficiently Random Values |
|---|
| Description | The web management interface of the Linksys RE6250 range extender (firmware v1.0.04.001) generates the administrator session ID with the C library PRNG seeded only by the current wall-clock second.No CSPRNG is involved (no /dev/urandom, no getrandom). The resulting 32-character value is handed to the client as the session_id cookie and is later validated by a bare strcmp() — with no source-IP binding. An unauthenticated attacker who knows (or can narrow down) the second in which the administrator logged in can compute the session ID offline and hijack the active admin session, obtaining full administrative control of the device. |
|---|
| Source | ⚠️ https://github.com/b1uerry/cves/blob/main/Linksys/RE6250/Linksys_RE6250_predictable_sessionId/details.md |
|---|
| User | bluerry (UID 94916) |
|---|
| Submission | 10/09/2026 08:23 (22 days ago) |
|---|
| Moderation | 10/21/2026 20:21 (12 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424944 [Linksys RE6250 1.0.04.001 Web Management Interface strcmp session_id random values] |
|---|
| Points | 20 |
|---|