PT-2026-21758 · Binardat · 10G08-0800Gsm Network Switch

Kazuma Matsumoto · Published 2026-02-24 · Updated 2026-02-25 · CVE-2026-27520

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209

Description The firmware stores a user password in a client-side cookie as a Base64-encoded value accessible via the web interface. Base64 encoding is reversible and does not provide confidentiality, allowing an attacker who can access the cookie value to recover the plaintext password.

Recommendations Update to firmware version V300SP10260209 or later.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2026-27520

Affected Products

10G08-0800Gsm Network Switch

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-27520 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27520 · Vendor Advisory
• https://twitter.com/CVEnew/status/2026676456286491130 · Twitter Post
• https://vulncheck.com/advisories/binardat-10g08-0800gsm-network-switch-base64-encoded-password-stored-in-cookie · Note
• https://twitter.com/RedPacketSec/status/2026537181603406156 · Twitter Post
• https://binardat.com/products/8-port-10-gigabit-sfp-managed-switch,-support-1g-sfp-and-10g-sfp-module,-160gbps-bandwidth,-l3-web-managed,-metal-fanless-fiber-binardat-network-switch · Note
• https://t.me/CVEtracker/45623 · Telegram Post