CVE-2023-45600 is a medium severity insufficient session expiration flaw, scored 5.6, in the AiLux imx6 web application. The sessionid cookie lasts two weeks, which makes session hijacking easier. Update to imx6_1.0.7-2 or later. Shorten exposure by signing out and limiting network access.
What's affected
The NVD record lists the AiLux imx6 bundle below version imx6_1.0.7-2 as affected. Nozomi Networks' advisory for CVE-2023-45591, which I read, gives the fix as updating to imx6 bundle version imx6_1.0.7-2, and its mitigations section is empty. The record for this CVE uses the same version boundary.
This is one of six CVEs in the same bundle that share the version boundary and the fix. The related records in this range are CVE-2023-45591, CVE-2023-45592, CVE-2023-45595, CVE-2023-45597, CVE-2023-45599 and CVE-2023-45600.
How to check if you're exposed
AiLux imx6 is a bundle for networked camera and edge devices. The version appears in the device's web interface or in the vendor's firmware information. The exact location depends on the device, so use the vendor's documentation.
If you operate these devices, record the bundle version for each and compare it with imx6_1.0.7-2. Anything below that version is in scope. Devices that cannot be updated should be kept off untrusted networks, and the web interface should not be reachable from the internet.
What to do now
- Identify devices that run the AiLux imx6 bundle and note the bundle version of each.
- Update to imx6_1.0.7-2 or later, as the vendor advisory directs.
- Restrict access to the device web interface to a management network.
- Review web interface accounts and remove any that are not needed.
- Confirm the version after the update and keep the record.
Why it matters
The weakness is insufficient session expiration, CWE-613. A session identifier that stays valid for two weeks gives a stolen cookie a long useful life. If someone copies it from a shared browser, a log or a network capture, they can reuse it for days.
The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, giving 5.6. The attack complexity is high because the attacker first has to obtain the cookie.
The CVE is not on the CISA KEV list. Until you update, sign out of the device interface when you finish, limit access to a management network, and avoid using shared browsers for device administration.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
How long does the cookie last?
Two weeks, according to the record.
Does signing out help?
It reduces the window on your side, but the fix is the vendor update.
Sources
- Nozomi Networks advisory for CVE-2023-45591
- Nozomi Networks advisory for CVE-2023-45600, listed in the NVD record
- NVD record data for CVE-2023-45600
Last reviewed: 19 October 2026.
