← Database

CVE-2026-120200

MEDIUM CVSS: 5.4 Published: 2026-10-31 Modified: 2026-10-31

Description

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.

Affected Platforms

Unknown

Weakness Type

CWE-639

References