CVE-2009-2367

highpriority · attend · 57EPSS 0.232 · 98 %ileexploit · functionalEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · functional

Likely / severe?

23.2% (98th) EPSS

CVSS 7.5 · high

Is it mine?

2 products

Check your exposure

Who says so?

2 sources

enisa_euvd · nvd

EPSS · scored 2026-10-23

cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the session_id parameter.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Fsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-338USprimary

exploits (1)

Public proof-of-concept and weaponised exploit code.

auxiliary/admin/http/iomega_storcenterpro_sessionidIomega StorCenter Pro NAS Web Authentication Bypassfunctional · metasploit

affected products (2)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
iomega storcenter pro firmwareall versionsnvdUScpe:2.3:o:iomega:storcenter_pro_firmware:*:*:*:*:*:*:*:*

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd nvd NVD CVE.org MITRE

published 2009-07-08modified 2026-06-16

related (265)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-53704US	critical9.8OT critical	95.3% (100th)	KEV	2025-01-09
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
CVE-2019-5420US	critical9.8OT critical	89.3% (100th)	Exploit	2019-03-27
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. Thi…
CVE-2023-34039US	critical9.8OT high	67.2% (99th)	Exploit	2023-08-29
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Ope…
CVE-2008-0166US	high7.5	70.7% (99th)	Exploit	2008-05-13
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remot…
CVE-2021-43799US	critical9.8	5.39% (93rd)	Exploit	2022-01-25
Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (un…

+260 more

references (8)

External citations — patches, advisories, analysis.

http://osvdb.org/55586 enisa_euvd
http://secunia.com/advisories/35666 enisa_euvd
http://trac.metasploit.com/browser/framework3/trunk/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb?rev=6733 enisa_euvd
https://exchange.xforce.ibmcloud.com/vulnerabilities/51539 enisa_euvd
http://osvdb.org/55586Broken LinkExploitnvd
http://secunia.com/advisories/35666Broken LinkVendor Advisorynvd
http://trac.metasploit.com/browser/framework3/trunk/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb?rev=6733Broken LinkExploitnvd
https://exchange.xforce.ibmcloud.com/vulnerabilities/51539Third Party AdvisoryVDB Entrynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan