Critical severity · published Feb 24, 2026
CVE-2026-27515
Binardat 10G08-0800GSM Network Switch Predictable Session Identifiers
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interface. An attacker can guess valid session IDs and hijack authenticated sessions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1N
10G08-0800GSM Network Switch · Binardat Ltd.
before V300SP10260209 · source: vendor
1F
10g08-0800gsm Firmware · Binardat
through V300SP10260209 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27515
Product
https://www.binardat.com/products/8-port-10-gigabit-sfp-managed-switch,-support-1g-sfp-and-10g-sfp-module,-160gbps-bandwidth,-l3-web-managed,-metal-fanless-fiber-binardat-network-switch
Third Party Advisory
https://www.vulncheck.com/advisories/binardat-10g08-0800gsm-network-switch-predictable-session-identifiers
More from 10G08-0800GSM Network Switch
9.8
CVE-2026-27507
Binardat 10G08-0800GSM Network Switch Hard-coded Credentials
8.8
CVE-2026-23678
Binardat 10G08-0800GSM Network Switch Traceroute CLI Command Injection
7.5
CVE-2026-27521
Binardat 10G08-0800GSM Network Switch Missing Login Rate Limiting
7.5
CVE-2026-27520
Binardat 10G08-0800GSM Network Switch Base64-encoded Password Stored in Cookie
7.5
CVE-2026-27519
Binardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key