CVE-2009-4509

CVE-2009-4509 describes a critical vulnerability in the administrative web console of TANDBERG Video Communication Server (VCS) versions prior to X4.3. The flaw stems from the use of predictable session cookies, specifically in secure.php scripts, enabling remote attackers to bypass authentication. This allows for arbitrary code execution by loading a custom software update. The vulnerability carries a CVSS score of 10.0, indicating maximum severity with a network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 84/100. Despite its high severity, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The CVE also lacks significant community discussion or media coverage, suggesting it has not garnered widespread attention.