CVE-2009-4509

Published: Apr 13, 2010Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg/web/lib/secure.php and (2) tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by loading a custom software update, via a crafted "Cookie: tandberg_login=" HTTP header.

Affected (10)

Products: Vsecurity: Tandberg Video Communication Server

Vsecurity

1 product

Tandberg Video Communication Server

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Vsecurity Tandberg Video Communication Server	Up to x4.2.1
Vsecurity Tandberg Video Communication Server	Version x1.0.0
Vsecurity Tandberg Video Communication Server	Version x1.1.0
Vsecurity Tandberg Video Communication Server	Version x1.2.0
Vsecurity Tandberg Video Communication Server	Version x2.0.0
Vsecurity Tandberg Video Communication Server	Version x2.1.0
Vsecurity Tandberg Video Communication Server	Version x3.0.0
Vsecurity Tandberg Video Communication Server	Version x3.1.0
Vsecurity Tandberg Video Communication Server	Version x4.1.0
Vsecurity Tandberg Video Communication Server	Version x4.2.0