CVE-2014-2378
05.09.2014, 17:55
Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.
| Vendor | Product | Version |
|---|---|---|
| sensysnetworks | trafficdot | 𝑥 ≤ 2.10.2 |
| sensysnetworks | trafficdot | 2.8.3 |
| sensysnetworks | trafficdot | 2.10.0 |
| sensysnetworks | trafficdot | 2.10.1 |
| sensysnetworks | vsn240-f | - |
| sensysnetworks | vsn240-t | - |
| sensysnetworks | vds | 𝑥 ≤ 2.10.0 |
| sensysnetworks | vds | 1.8.5 |
| sensysnetworks | vds | 1.8.7 |
| sensysnetworks | vds | 2.6.3 |
| sensysnetworks | vds | 2.6.4 |
| sensysnetworks | vsn240-f | - |
| sensysnetworks | vsn240-t | - |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-494 - Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
- CWE-94 - Improper Control of Generation of Code ('Code Injection')The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.