CVE-2014-9754

Published: Jan 20, 2017Modified: May 13, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.

Affected (2)

Products: Viprinet: Multichannel Vpn Router 300 Firmware

1 product

Multichannel Vpn Router 300 Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Viprinet Multichannel Vpn Router 300 Firmware	Version 2013070830
Viprinet Multichannel Vpn Router 300 Firmware	Version 2013080900

Running on/with	Platform Versions
Viprinet Multichannel Vpn Router 300	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300-Identity-Verification-Fail.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Feb/8

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/archive/1/537441/100/0/threaded

Source: cve@mitre.org

http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300-Identity-Verification-Fail.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Feb/8

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/archive/1/537441/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.