HIJACKING OF THE TOKEN AND GAINING ACCESS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.
Summary
The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session detecting it. The web server allows the attacker to reuse an old session JWT token while the legitimate session is active.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SGE-PLC1000 SGE-PLC50 | TCPRS1plus | 1.0.14 | — | No fix listed | CNA |
- TCPRS1plus VendorSGE-PLC1000 SGE-PLC50 Affected 1.0.14 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64386
- 2026-10-03 Alias added: GHSA-4m38-cfr7-jx25
References
More SGE-PLC1000 SGE-PLC50 vulnerabilities
- TI-2024-08251 Authentication bypass vulnerability on CIRCUTOR Q-SMT CVSS 3.1CRITICAL 10.0
- TI-2025-10798 Stack-based buffer overflow vulnreability in Circutor SGE-PLC1000/SGE-PLC50 CVSS 4.0CRITICAL 10.0
- TI-2024-08252 Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT CVSS 3.1CRITICAL 10.0
- TI-2021-13186 Circutor SGE-PLC1000 OS command Injection CVSS 3.1CRITICAL 10.0
- TI-2021-08431 Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT… CVSS 3.1CRITICAL 9.8
- TI-2025-39821 Denial of service through specific packets CVSS 4.0CRITICAL 9.2
Sources
- CVE-2025-64386 · CVE Program
- CVE-2025-64386 · NVD
- FIRST EPSS
- GHSA-4m38-cfr7-jx25 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences