CVE-2014-7994

Published: Dec 24, 2014Modified: May 6, 2026

5.4

Vector

AV:A/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 5.5 / Impact: 6.4

Source: NVD

Description

Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbitrary commands by leveraging knowledge of a cross-device secret and a per-device secret, and sending a request to an unspecified HTTP handler on the local network, aka Cisco-Meraki defect ID 00301991.

Affected (6)

Products: Cisco: Meraki Mr Firmware, Meraki Mr, Meraki Mx Firmware, Meraki Mx, Meraki Ms Firmware, Meraki Ms

6 products

Meraki Mr Firmware

Meraki Mx Firmware

Meraki Ms Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Cisco Meraki Mr Firmware	Up to 2014-09-24
Cisco Meraki Mr	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Cisco Meraki Mx Firmware	Up to 2014-09-24
Cisco Meraki Mx	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Cisco Meraki Ms Firmware	Up to 2014-09-24
Cisco Meraki Ms	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://tools.cisco.com/security/center/viewAlert.x?alertId=36798

Source: psirt@cisco.com

Vendor Advisory

https://dashboard.meraki.com/firmware_security

Source: psirt@cisco.com

http://tools.cisco.com/security/center/viewAlert.x?alertId=36798

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://dashboard.meraki.com/firmware_security

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.