CVE-2024-33610

The record

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Affected packages

Related vulnerabilities

• CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
• CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
• CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288
• CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email… CWE-288
• CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in… CWE-288
• CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an… CWE-288
• CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. CWE-288
• CVE-2026-81783 Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. CWE-288