CVE-2026-27515

CriticalPublic PoC

Published: 24 February 2026

Published

24 February 2026

Modified

25 February 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0005 14.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27515 is a critical-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Binardat 10G08-0800Gsm Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-23 Session Authenticity good match

prevent

Requires mechanisms to protect the authenticity of web management sessions, directly countering hijacking via predictable numeric session identifiers.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of the firmware flaw in versions prior to V300SP10260209 that generates predictable session IDs, via patching and updates.

AC-12 Session Termination partial match

prevent

Enforces automatic session termination after inactivity or other conditions, limiting the viable window for exploitation of guessed session IDs.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

Why these techniques?

Predictable session IDs in public-facing web management interface directly enable remote exploitation of the application without credentials (T1190) and use of guessed/predicted session tokens as alternate web authentication material (T1550.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interface. An attacker can guess valid session IDs and hijack authenticated sessions.

Deeper analysisAI

CVE-2026-27515 affects the firmware of Binardat 10G08-0800GSM network switches, specifically versions prior to V300SP10260209. The vulnerability stems from the generation of predictable numeric session identifiers in the web management interface, classified under CWE-330 (Use of Insufficiently Random Values). This flaw enables attackers to guess valid session IDs and hijack authenticated sessions. The issue received a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.

A remote attacker requires no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. By enumerating predictable session IDs, the attacker can impersonate legitimate users, gaining unauthorized access to the web management interface. This allows exfiltration of sensitive configuration data (high confidentiality impact) and unauthorized modifications to switch settings (high integrity impact), potentially leading to network compromise without disrupting availability.

Advisories, including those from VulnCheck and the Binardat product page, highlight the need to upgrade to firmware version V300SP10260209 or later to mitigate the predictable session ID generation. Security practitioners should verify firmware versions on affected devices and apply updates promptly, while also implementing network segmentation and monitoring for anomalous web management access.