GCOM EPON 1GE ONU Session Hijacking Vulnerability

A session hijacking vulnerability has been identified in the GCOM EPON 1GE ONU model, specifically in the C00R371V00B01 firmware version. The issue arises from improper session management in the web management interface, where the application relies solely on the client's IP address for session identification. This lack of secure session cookies or tokens allows an attacker on the local network to spoof the IP address of an authenticated user, gaining unauthorized access to the administrative interface and the ability to perform arbitrary actions without valid credentials.

Impact

Exploitation of this vulnerability allows for session hijacking, enabling unauthorized users to access the administrative interface and perform actions as if they were the authenticated user.