Critical Vulnerability Uncovered: Session Hijacking in Sencore SMP100 Media Platforms (CVE-2025-63226)

Overview

This blog post details CVE-2025-63226, a critical session hijacking vulnerability affecting Sencore SMP100 SMP Media Platforms. Specifically, firmware versions V4.2.160, V60.1.4, and V60.1.29 are susceptible to this flaw. The vulnerability stems from improper session management on the /UserManagement.html endpoint. An attacker on the same network as a logged-in user can exploit this to access the endpoint and create new user accounts without authentication, leading to unauthorized system access and potential malicious activities.

Technical Details

The vulnerability lies in the Sencore SMP100’s handling of user sessions. When a user successfully authenticates and logs into the system, a session is established. However, the /UserManagement.html endpoint fails to adequately validate the session’s integrity. An attacker on the same network can intercept or otherwise obtain a valid session identifier. With this session identifier, they can directly access the /UserManagement.html page and add new users. The critical lack of authentication on this endpoint allows the attacker to bypass normal security measures.

This attack requires the attacker to be on the same network segment as the targeted Sencore SMP100 device and have a valid (or spoofed) session ID for an already logged in user. The process involves:

1. Attacker gains access to the network where the Sencore SMP100 device resides.
2. Attacker identifies a valid session ID of a logged-in user (e.g., through network sniffing or social engineering).
3. Attacker crafts a request to the /UserManagement.html endpoint, including the captured session ID.
4. The Sencore SMP100 incorrectly authenticates the attacker based solely on the provided session ID, allowing them to add new user accounts.

CVSS Analysis

Currently, a CVSS score has not been assigned to CVE-2025-63226. Given the potential for unauthorized access and system compromise, this vulnerability warrants serious attention. A high CVSS score is anticipated due to the ease of exploitation (network proximity being the primary requirement) and the significant impact of gaining administrative control.

Possible Impact

The exploitation of CVE-2025-63226 can have severe consequences:

• Unauthorized System Access: Attackers can gain full control of the Sencore SMP100 device.
• Data Breach: Attackers may access sensitive data stored on or processed by the media platform.
• Service Disruption: Attackers can disrupt media streaming services or other critical functionalities.
• Malware Deployment: Attackers can use the compromised system as a launchpad for further attacks on the network.
• Reputational Damage: Compromise of a media platform can lead to significant reputational damage for the organization using the device.

Mitigation and Patch Steps

The following steps are recommended to mitigate the risk associated with CVE-2025-63226:

• Apply the Patch: The most effective solution is to upgrade to a patched firmware version released by Sencore. Contact Sencore support or visit their website for the latest firmware updates.
• Network Segmentation: Isolate the Sencore SMP100 device on a separate network segment with restricted access.
• Monitor Network Traffic: Implement network monitoring to detect suspicious activity, such as unauthorized access attempts to the /UserManagement.html endpoint.
• Strong Passwords: Enforce strong password policies for all user accounts on the system.
• Multi-Factor Authentication (MFA): If supported, enable MFA for all user accounts to add an extra layer of security.

Important Note: Until a patch is available, implementing network segmentation and closely monitoring network traffic are crucial for mitigating the immediate risk.

References

• CVE ID: CVE-2025-63226
• Vulnerability Research: GitHub Repository
• Sencore Website: Sencore