CyberRota Analysis
AI-GeneratedThe vulnerability affects SafeLine versions up to 9.4.1, where the management console session-signing secret is derived from a predictable time-seeded random number generator. This flaw allows unauthenticated remote attackers with knowledge of the installation timestamp to regenerate the session secret, enabling them to forge valid administrator session cookies and potentially take control of protected sites. Organizations using SafeLine should prioritize patching this vulnerability to mitigate the risk of unauthorized access to their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.