CVE-2024-49709

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser might set such a cookie, wait until the user logs in and then use the same cookie to take over the account. Moreover, the system does not destroy the old sessions when creating new ones, what expands the time frame in which an attack might be performed.  This vulnerability has been patched in version 79.0

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published
Apr 14, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-49715.4The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all verCVE-2024-497147.8In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device eCVE-2024-49729.8A vulnerability classified as critical has been found in code-projects Simple Chat System 1.0. This affects an unknown part of the file /logCVE-2024-497207.8In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic eCVE-2024-497225.5In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to CVE-2024-497247.0In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a CVE-2024-497285.5In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lCVE-2024-49739.8A vulnerability classified as critical was found in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the filCVE-2024-497307.8In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with nCVE-2024-497314.0In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to aCVE-2024-497327.8In multiple functions of CompanionDeviceManagerService.java, there is a possible way to grant permissions without user consent due to a missCVE-2024-497335.5In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the
CVE-2024-49709: Medium severity, CVSS 4.4 | Vulnix