CVE-2014-2378
7.6
Vector
AV:A/AC:M/Au:N/C:C/I:C/A:P
Exploitability: 5.5 / Impact: 9.5
Source: NVD
Description
Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.
Affected (11)
Products: Sensysnetworks: Trafficdot, Vds, Vsn240 F, Vsn240 T
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 2.10.2 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 2.10.0 | |
| All versions | |
| All versions |
Related CWEs
CWE-494
Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
References (4)
Source: ics-cert@hq.dhs.gov
Source: ics-cert@hq.dhs.gov
Source: ics-cert@hq.dhs.gov
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
Timeline
No history available yet.