ntopng versions up to 6.6 create HTTP session identifiers using a time‑seeded pseudo‑random number generator. The exposed web interface issues session cookies when a user logs in; because the seed is predictable, an attacker can cause two sessions to receive the same or an easily predicted cookie value. This deterministic or colliding session ID allows the attacker to hijack a legitimate authenticated session and impersonate a user. The weakness is defined as a Predictable Session Identifier (CWE-341).

Any host running ntopng through 6.6 with the web interface exposed is affected. The vulnerability exists in all releases up to and including 6.6; it has been fixed in later versions and by applying the commits referenced in the advisory. Hosts that restrict web access or run newer versions are not susceptible.

The CVSS score of 9.8 reflects a high severity impact. The EPSS score is below 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the potential for session hijacking means that once an attacker obtains a predictable session cookie, they can gain full privileges. The likely attack vector is remote, via the web interface, where the attacker controls the timing of logins to generate a desired session ID.