Artica Proxy before version 4.50.000000 Service Pack 7 allows an unauthenticated attacker to set a known PHPSESSID value in a victim’s browser. When the victim subsequently authenticates through fw.login.php on port 9000, the attacker gains a fully authenticated administrative session. The vulnerability arises from insufficient protection against session fixation, enabling remote privilege escalation. This flaw allows the attacker to become a fully authenticated administrator after the victim logs in, without executing arbitrary code.

Vulnerable systems are Artica Proxy deployments running any build of 4.50.000000 before Service Pack 7. The issue impacts the default administrative web interface on port 9000 and, by extension, any service that utilizes this inter‑session mechanism. Users of ArticaTech’s Proxy product should review the build number and service pack in use.

The CVSS score of 7.5 classifies the vulnerability as high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog, indicating no known active exploitation. Nevertheless, a successful exploit would grant full administrative access, enabling arbitrary configuration changes or further lateral movement. The attack requires the ability to pre‑set a PHPSESSID cookie before the victim logs in, a capability that can be achieved remotely via crafted URLs or cross‑site request forgery.