What is the CVSS score of CVE-2014-2378?

CVE-2014-2378 has a CVSS 2.0 base score of 6.5 (Medium). CVSS vector: AV:A/AC:H/Au:N/C:C/I:C/A:P. EPSS exploitation probability: 0.2%.

Trafficdot CVE-2014-2378

MEDIUM

Download of Code Without Integrity Check (CWE-494)

2014-09-05 ics-cert@hq.dhs.gov

RCE Trafficdot Vsn240 F Vsn240 T Vds

6.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:H/Au:N/C:C/I:C/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:A/AC:H/Au:N/C:C/I:C/A:P

Attack Vector

Adjacent

Attack Complexity

High

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 05, 2014 - 17:55 cve.org

MEDIUM 6.5

DescriptionCVE.org

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-494. Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update. Affected products include: Sensysnetworks Trafficdot, Sensysnetworks Vsn240-F, Sensysnetworks Vsn240-T, Sensysnetworks Vds. Version information: before 2.10.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.