CVE-2009-4295

CVE-2009-4295 describes a critical vulnerability in Sun Ray Server Software 4.0 and 4.1, affecting Sun Ray 1, 1g, 100, and 150 DTU devices. The flaw stems from the software's failure to generate unique DSA private keys for each device's firmware. This design oversight allows remote attackers to predict keys, facilitating the decryption of sniffed network traffic and potentially leading to sensitive information disclosure. The vulnerability carries a CVSS score of 7.8, indicating high severity due to its network-based attack vector and low attack complexity, requiring no authentication. While the direct impact is information disclosure (C:C), the lack of unique keys creates a significant security weakness. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has garnered minimal community attention and media coverage, suggesting it is not widely discussed or targeted.