CVE-2014-2005

Published: Jun 25, 2014Modified: May 6, 2026

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

Sophos Disk Encryption (SDE) 5.x in Sophos Enterprise Console (SEC) 5.x before 5.2.2 does not enforce intended authentication requirements for a resume action from sleep mode, which allows physically proximate attackers to obtain desktop access by leveraging the absence of a login screen.

Affected (4)

Products: Sophos: Enterprise Console

1 product

Enterprise Console

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Sophos Enterprise Console	Up to 5.2.1
Sophos Enterprise Console	Version 5.1
Sophos Enterprise Console	Version 5.2.1
Sophos Enterprise Console	Version 5.2

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (8)

http://jvn.jp/en/jp/JVN63940326/index.html

Source: vultures@jpcert.or.jp

Third Party AdvisoryVDB Entry

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000061

Source: vultures@jpcert.or.jp

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/68169

Source: vultures@jpcert.or.jp

Third Party AdvisoryVDB Entry

http://www.sophos.com/en-us/support/knowledgebase/121066.aspx

Source: vultures@jpcert.or.jp

Vendor Advisory

http://jvn.jp/en/jp/JVN63940326/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000061

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/68169

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.sophos.com/en-us/support/knowledgebase/121066.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.