CVE-2020-26732

HIGH

SKYWORTH GN542VF 2.0.0.16 - Missing Secure Flag for Session Cookie

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-26732. PoCs published by swzhouu.

AI-analyzed exploit summary This repository documents CVE-2020-26732, a vulnerability in SKYWORTH GN542VF where session cookies lack the Secure flag in HTTPS sessions, making them susceptible to interception. The PoC is a descriptive writeup with a screenshot demonstrating the issue.

Description

SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

Exploits (1)

nomisec WRITEUP 1 stars
by swzhouu · poc
https://github.com/swzhouu/CVE-2020-26732

This repository documents CVE-2020-26732, a vulnerability in SKYWORTH GN542VF where session cookies lack the Secure flag in HTTPS sessions, making them susceptible to interception. The PoC is a descriptive writeup with a screenshot demonstrating the issue.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16
No auth needed
Prerequisites: Network access to intercept traffic · HTTPS session with the vulnerable device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0151
EPSS Percentile 71.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-311
Status published
Products (1)
skyworth/gn542vf_boa_firmware 0.94.13
Published Jan 14, 2021
Tracked Since Feb 18, 2026