VOS Node.js ZTP web service uses predictable session IDs

critical severity · published 2026-11-10

The Node.js web service on VOS generates session IDs using UUID version 1, derived from the system clock and MAC address, so successive IDs can be predicted. An attacker who predicts a user's session ID can hijack that user's session.

CVE: CVE-2026-107242

Source: NVD

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2589 and your operating system.