HTTP TRACE cross-site tracing (CVE-2004-2320)

Sep 09, 2026

Enabled HTTP TRACE methods allow remote attackers to steal sensitive data.

Vulnerability ID	Vulnerability Overview
CVE-2004-2320	Web servers responding to HTTP TRACE requests are vulnerable to Cross-Site Tracing (XST), which enables attackers to bypass `HttpOnly` cookie protections and access sensitive session information.

Affected Supported TeraStations

TS5010/3020/3010
Fixed in firmware version 6.12

Date	Description
09/09/2026	Initial release