Description
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Toptech Systems | TMS7 | 7.6.3 | 7.8 |
| Toptech Systems | TopHAT | 7.6.3 | 7.8 |
Advisories 1
- ICSA-26-272-02 Toptech TMS7 and TopHAT CISA ICS & IT advisories · Sep 29, 2026