CVE-2020-29667

Published: Dec 10, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system because of Insufficient Session Expiration.

Affected (1)

Products: Lanatmservice: M3 Atm Monitoring System

Lanatmservice

1 product

M3 Atm Monitoring System

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lanatmservice M3 Atm Monitoring System	Version 6.1.0

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

http://lanatmservice.ru/

Source: cve@mitre.org

Vendor Advisory

https://github.com/jet-pentest/CVE-2020-29667

Source: cve@mitre.org

Third Party Advisory

http://lanatmservice.ru/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/jet-pentest/CVE-2020-29667

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.