Information disclosure in Gatesair Flexiva Lx100
CVE-2025-63212
GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the publicly accessible log file located at /log/Flexiva%20LX.log. An unauthenticated attacker can retrieve valid session IDs and hijack sessions without providing any credentials. This attack requires the legitimate user (admin) to have previously closed the browser window without logging out.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Gatesair Flexiva Lx100
- Gatesair Flexiva Lx1000
- Gatesair Flexiva Lx1000 Firmware — versions 1.0.13, 2.0
- Gatesair Flexiva Lx100 Firmware — versions 1.0.13, 2.0
- Gatesair Flexiva Lx300
- Gatesair Flexiva Lx300 Firmware — versions 1.0.13, 2.0
- Gatesair Flexiva Lx600
- Gatesair Flexiva Lx600 Firmware — versions 1.0.13, 2.0
Weakness classification (CWE)
References
- www.gatesair.com/ (Product)
- github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63212 _Gate… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-63212?
- CVE-2025-63212 is a medium-severity vulnerability in Gatesair Flexiva Lx100, classified under Information Disclosure. CVSS score: 6.5/10. Published 2025-11-19.
- How severe is CVE-2025-63212?
- Medium severity. CVSS v3 base score is 6.5 out of 10.