Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interface. This predictable session ID generation (CWE‑330) allows an attacker to guess valid session IDs and hijack authenticated sessions, effectively gaining unauthorized administrative access to the switch and potentially compromising the entire network segment.

Vendors: Binardat Ltd.; Product: 10G08-0800GSM Network Switch; Affected Firmware: all versions prior to V300SP10260209.

The flaw has a CVSS score of 9.3, indicating a severe impact, but the EPSS score is below 1%, suggesting that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. An attacker who can reach the device’s management interface over the network could exploit the flaw by simply guessing session identifiers. The attack does not require local access or privileged credentials, making it potentially reachable from a compromised host within the same subnet or, if exposed, remotely. Given the high severity combined with the possibility of remote exploitation, organizations should consider this a high‑priority risk.