Information disclosure in Gatesair Flexiva Lx100
CVE-2025-63212
GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the publicly accessible log file located at /log/Flexiva%20LX.log. An unauthenticated attacker can retrieve valid session IDs and hijack sessions without providing any credentials. This attack requires the legitimate user (admin) to have previously closed the browser window without logging out.
Vulnerability class: Information Disclosure
EPSS: 0.004 (29.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Gatesair Flexiva_lx100
- Gatesair Flexiva_lx1000
- Gatesair Flexiva_lx1000_firmware — versions 1.0.13, 2.0
- Gatesair Flexiva_lx100_firmware — versions 1.0.13, 2.0
- Gatesair Flexiva_lx300
- Gatesair Flexiva_lx300_firmware — versions 1.0.13, 2.0
- Gatesair Flexiva_lx600
- Gatesair Flexiva_lx600_firmware — versions 1.0.13, 2.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-63212?
- CVE-2025-63212 is a medium-severity vulnerability in Gatesair Flexiva Lx100, classified under Information Disclosure. CVSS score: 6.5/10. Published 2025-11-19.
- How severe is CVE-2025-63212?
- Medium severity. CVSS v3 base score is 6.5 out of 10.