Lucene search

MitreCVE-2014-9002

HistoryNov 20, 2014 - 1:55 p.m.

CVE-2014-9002

2014-11-2013:55:12

CWE-264

mitre

web.nvd.nist.gov

lantronix

xprintserver

remote code execution

cve-2014-9002

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

9.7

Confidence

High

EPSS

0.031

Percentile

91.1%

JSON

Lantronix xPrintServer does not properly restrict access to ips/, which allows remote attackers to execute arbitrary commands via the c parameter in an rpc action.

Affected configurations

Nvd

Node

lantronixxprintserverMatch-

VendorProductVersionCPE
lantronixxprintserver-cpe:2.3:h:lantronix:xprintserver:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lantronix	xprintserver	-	cpe:2.3:h:lantronix:xprintserver:-:::::::*

References

i.imgur.com/gjbZhXZ.png

packetstormsecurity.com/files/129091/Lantronix-xPrintServer-Remote-Command-Execution-CSRF.html

seclists.org/fulldisclosure/2014/Nov/24

exchange.xforce.ibmcloud.com/vulnerabilities/98644

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

9.7

Confidence

High

EPSS

0.031

Percentile

91.1%

JSON

Related for CVE-2014-9002