GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the publicly accessible log file located at /log/Flexiva%20LX.log. An unauthenticated attacker can retrieve valid session IDs and hijack sessions without providing any credentials. This attack requires the legitimate user (admin) to have previously closed the browser window without logging out.
CVE-2025-63212
CVSS base score
6.5 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-200
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
gatesair flexiva lx100 firmware
gatesair flexiva lx300 firmware
gatesair flexiva lx600 firmware
gatesair flexiva lx1000 firmware
References
- github.com Exploit, Third Party Advisory
- www.gatesair.com Product