PT-2025-6969 · Gatesair · Gatesair Maxiva Vaxt

Mohamed Shahat · Published 2025-02-13 · Updated 2025-02-14 · CVE-2025-22960

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GatesAir Maxiva UAXT, VAXT transmitters (affected versions not specified)

Description: A session hijacking issue exists in the web-based management interface, allowing unauthenticated attackers to access exposed log files at "/logs/debug/xteLog*" endpoints, potentially revealing sensitive session-related information such as session IDs (sess id) and authentication success tokens (user check password OK). This could enable attackers to hijack active sessions, gain unauthorized access, and escalate privileges on affected devices.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-22960

Affected Products

Gatesair Maxiva Vaxt

References · 5

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-22960 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-22960 · Security Note
• https://twitter.com/VulmonFeeds/status/1890243836523209194 · Twitter Post
• https://twitter.com/CVEnew/status/1890170600611836361 · Twitter Post
• https://t.me/cvedetector/18056 · Telegram Post