Lucene search

VulDBCVELIST:CVE-2014-125001

HistoryMay 24, 2022 - 3:30 p.m.

CVE-2014-125001 Cardo Systems Scala Rider Q3 Cardo-Updater api privileges management

2022-05-2415:30:33

CWE-269

VulDB

www.cve.org

vulnerability

cardo systems scala rider q3

cardo-updater

remote code execution

unauthenticated

root permissions

firewalling

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended.

CNA Affected

[
  {
    "product": "Scala Rider Q3",
    "vendor": "Cardo Systems",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

www.remote-exploit.org/archives/2014/06/03/ride_with_the_devil/

vuldb.com/?id.13428

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON

Related for CVELIST:CVE-2014-125001