CVE-2002-0209 describes a vulnerability in Nortel Alteon ACEdirector WebOS 9.0, specifically when Server Load Balancing (SLB) and Cookie-Based Persistence are enabled. Remote attackers can exploit a half-closed session to determine the real IP address of a web server, as ACEdirector fails to translate the server's IP to the virtual IP in this scenario. This vulnerability has a CVSS score of 5.0 (medium severity), indicating a network-based attack with low complexity, requiring no authentication, and primarily impacting confidentiality. While not listed on CISA's KEV catalog, exploit code exists on ExploitDB, and it has garnered significant community discussion, though no Metasploit or Nuclei modules are available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
9.0CPE matchmatch criteria | cpe:2.3:h:nortel:alteon_acedirector:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.