CVE-2014-7249

Published: Dec 19, 2014Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 9924SP, CentreCOM 9924T/4SP, Rapier 48i, and SwitchBlade4000 with firmware before 2.9.1-21 allows remote attackers to execute arbitrary code via a crafted HTTP POST request.

Affected (48)

Products: Alliedtelesis: Centrecom Ar415s Firmware, Centrecom Ar415s, At 8624t/2m Firmware, At 8624t/2m, Ar442s Firmware, Ar442s, At 9924t Firmware, At 9924t, At 8848 Firmware, At 8848, Rapier 48i Firmware, Rapier 48i, Centrecom Ar450s Firmware, Centrecom Ar450s, Ar745 Firmware, Ar745, Ar441s Firmware, Ar441s, Centrecom 9924sp Firmware, Centrecom 9924sp, Switchblade4000 Firmware, Switchblade4000, At 8624poe Firmware, At 8624poe, Centrecom 9924t/4sp Firmware, Centrecom 9924t/4sp, At 9816gb Firmware, At 9816gb, At 9924ts Firmware, At 9924ts, Ar750s Firmware, Ar750s, Centrecom Ar570s Firmware, Centrecom Ar570s, Centrecom 8948xl Firmware, Centrecom 8948xl, At 8648t/2sp Firmware, At 8648t/2sp, Centrecom 8700sl Firmware, Centrecom Ar8700sl, Ar750s Dp Firmware, Ar750s Dp, Centrecom Ar550s Firmware, Centrecom Ar550s, At 8748xl Firmware, At 8748xl, Ar440s Firmware, Ar440s

Alliedtelesis

48 products

Centrecom Ar415s Firmware

Centrecom Ar450s Firmware

Centrecom 9924sp Firmware

Centrecom 9924sp

Switchblade4000 Firmware

Switchblade4000

At 8624poe Firmware

At 8624poe

Centrecom 9924t/4sp Firmware

Centrecom Ar570s Firmware

Centrecom Ar570s

Centrecom 8948xl Firmware

Centrecom 8948xl

At 8648t/2sp Firmware

At 8648t/2sp

Centrecom 8700sl Firmware

Centrecom Ar8700sl

Ar750s Dp Firmware

Ar750s Dp

Centrecom Ar550s Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom Ar415s Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom Ar415s	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 8624t/2m Firmware	Up to 2.9.1-20
Alliedtelesis At 8624t/2m	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Ar442s Firmware	Up to 2.9.1-20
Alliedtelesis Ar442s	All versions

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 9924t Firmware	Up to 2.9.1-20
Alliedtelesis At 9924t	All versions

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 8848 Firmware	Up to 2.9.1-20
Alliedtelesis At 8848	All versions

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Rapier 48i Firmware	Up to 2.9.1-20
Alliedtelesis Rapier 48i	All versions

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom Ar450s Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom Ar450s	All versions

Configuration H

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Ar745 Firmware	Up to 2.9.1-20
Alliedtelesis Ar745	All versions

Configuration I

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Ar441s Firmware	Up to 2.9.1-20
Alliedtelesis Ar441s	All versions

Configuration J

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom 9924sp Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom 9924sp	All versions

Configuration K

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Switchblade4000 Firmware	Up to 2.9.1-20
Alliedtelesis Switchblade4000	All versions

Configuration L

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 8624poe Firmware	Up to 2.9.1-20
Alliedtelesis At 8624poe	All versions

Configuration M

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom 9924t/4sp Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom 9924t/4sp	All versions

Configuration N

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 9816gb Firmware	Up to 2.9.1-20
Alliedtelesis At 9816gb	All versions

Configuration O

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 9924ts Firmware	Up to 2.9.1-20
Alliedtelesis At 9924ts	All versions

Configuration P

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Ar750s Firmware	Up to 2.9.1-20
Alliedtelesis Ar750s	All versions

Configuration Q

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom Ar570s Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom Ar570s	All versions

Configuration R

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom 8948xl Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom 8948xl	All versions

Configuration S

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 8648t/2sp Firmware	Up to 2.9.1-20
Alliedtelesis At 8648t/2sp	All versions

Configuration T

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom 8700sl Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom Ar8700sl	All versions

Configuration U

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Ar750s Dp Firmware	Up to 2.9.1-20
Alliedtelesis Ar750s Dp	All versions

Configuration V

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Centrecom Ar550s Firmware	Up to 2.9.1-20
Alliedtelesis Centrecom Ar550s	All versions

Configuration W

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis At 8748xl Firmware	Up to 2.9.1-20
Alliedtelesis At 8748xl	All versions

Configuration X

2 vulnerable

Vulnerable Software	Affected Versions
Alliedtelesis Ar440s Firmware	Up to 2.9.1-20
Alliedtelesis Ar440s	All versions

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (6)

http://jvn.jp/en/jp/JVN22440986/index.html

Source: vultures@jpcert.or.jp

Vendor Advisory

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000132

Source: vultures@jpcert.or.jp

Vendor Advisory

http://www.allied-telesis.co.jp/support/list/faq/vuls/20141111aen.html

Source: vultures@jpcert.or.jp

Vendor Advisory

http://jvn.jp/en/jp/JVN22440986/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000132

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.allied-telesis.co.jp/support/list/faq/vuls/20141111aen.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.