CVE-2019-7280

CVE-2019-7280 describes an authentication bypass vulnerability in Prima Systems FlexAir versions 2.3.38 and prior, stemming from an insufficient session ID length. This allows a remote attacker to brute-force session IDs, gain unauthorized access, and potentially compromise the system. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low complexity and no user interaction, leading to high impacts on confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community.