CVE-2013-4732

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

The administrative web server on the Digital Alert Systems DASDEC EAS device through 2.0-2 and the Monroe Electronics R189 One-Net EAS device through 2.0-2 uses predictable session ID values, which makes it easier for remote attackers to hijack sessions by sniffing the network. NOTE: VU#662676 states "Monroe Electronics could not reproduce this finding.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdfVendor Advisory
http://www.kb.cert.org/vuls/id/662676US Government Resource
http://www.kb.cert.org/vuls/id/AAMN-98MU7HUS Government Resource
http://www.kb.cert.org/vuls/id/AAMN-98MUK2US Government Resource
http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdfVendor Advisory
http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdfVendor Advisory
http://www.kb.cert.org/vuls/id/662676US Government Resource
http://www.kb.cert.org/vuls/id/AAMN-98MU7HUS Government Resource
http://www.kb.cert.org/vuls/id/AAMN-98MUK2US Government Resource
http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdfVendor Advisory

Timeline

Published: Jun 30, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-47337.5The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 a CVE-2013-47347.3dasdec_mkuser on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 ge CVE-2013-473510.0The Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 have a default pass CVE-2013-47367.8Multiple integer overflows in the JPEG engine drivers in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innov CVE-2013-47379.3The CONFIG_STRICT_MEMORY_RWX implementation for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for CVE-2013-47387.2Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Androi CVE-2013-47394.9The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other CVE-2013-47406.9goodix_tool.c in the Goodix gt915 touchscreen driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contribu CVE-2013-47427.5Buffer overflow in NetWin SurgeFTP before 23d2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary co CVE-2013-47439.8Static HTTP Server 1.0 has a Local Overflow CVE-2013-47444.3Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web sc CVE-2013-47457.5SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to execute arbitra