CVE-2025-69270 is a critical flaw (CVSS 9.8) in Broadcom DX NetOps Spectrum 24.3.8 and earlier. Sensitive information is exposed in the query strings of GET requests, which allows session hijacking. The record names no fixed version, so use Broadcom security advisory 36756.
What's affected
- Broadcom DX NetOps Spectrum 24.3.8 and earlier, on Windows and Linux.
- Fixed version: not stated in the record. See Broadcom security advisory 36756.
How to check if you're exposed
Check the installed Spectrum version against 24.3.8. Anything at or below it is in scope.
Then think about where query strings are recorded: browser history, proxy logs, web server logs and monitoring tools. If Spectrum URLs carrying session data pass through a shared proxy, those logs are part of your exposure.
What to do now
- Find all Spectrum servers and their versions.
- Apply the remediation in Broadcom advisory 36756.
- After patching, invalidate active sessions so any captured identifiers stop working.
- Restrict who can read proxy and web server logs that hold Spectrum URLs.
- Serve Spectrum only over HTTPS on management networks.
Query string secrets are best found by reading your own logs. Search proxy and web server logs for long token like values in URLs on the Spectrum hosts, and set a short retention for logs that contain them. That shows whether the exposure is theoretical or already sitting in files others can read.
Why it matters
The weakness is CWE-598, use of a GET request method with sensitive query strings. A URL is copied into many places that were never meant to keep secrets: logs, caches, the Referer header and browser history. If a session identifier is in the URL, anyone who reads one of those copies can use it.
The result is session hijacking, where an attacker acts as a signed in user without a password. Fixing it means moving sensitive values out of the URL, which is why a vendor update is needed. This CVE shares an advisory with CVE-2025-69269. The record does not list it as exploited in the wild.
Quick check
Why are sensitive values in a URL a problem?
URLs end up in logs, browser history and Referer headers, so a secret there can be read by anyone with access to those copies.
Sources
Last reviewed: 19 October 2026.
