Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessible via the web interface. Because Base64 is reversible and provides no confidentiality, an attacker who can access the cookie value can recover the plaintext password.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
25 Feb 2026, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Binardat 10g08-0800gsm
Binardat 10g08-0800gsm Firmware Binardat |
|
| CPE | cpe:2.3:o:binardat:10g08-0800gsm_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:binardat:10g08-0800gsm:-:*:*:*:*:*:*:* |
|
| References | () https://www.binardat.com/products/8-port-10-gigabit-sfp-managed-switch,-support-1g-sfp-and-10g-sfp-module,-160gbps-bandwidth,-l3-web-managed,-metal-fanless-fiber-binardat-network-switch - Product | |
| References | () https://www.vulncheck.com/advisories/binardat-10g08-0800gsm-network-switch-base64-encoded-password-stored-in-cookie - Third Party Advisory |
24 Feb 2026, 16:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-24 16:24
Updated : 2026-02-25 17:25
NVD link : CVE-2026-27520
Mitre link : CVE-2026-27520
CVE.ORG link : CVE-2026-27520
JSON object : View
Products Affected
binardat
- 10g08-0800gsm_firmware
- 10g08-0800gsm
CWE
CWE-312
Cleartext Storage of Sensitive Information