What is the CVSS score of CVE-2014-8243?

CVE-2014-8243 has a CVSS 2.0 base score of 3.3 (Low). CVSS vector: AV:A/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2014-8243?

Yes, a public proof-of-concept exploit is available for CVE-2014-8243. Prioritise patching immediately. EPSS: 0.2%.

Ea4500 Firmware CVE-2014-8243

LOW

Cryptographic Issues (CWE-310)

2014-11-01 cret@cert.org

Linksys Information Disclosure Ea4500 Firmware Ea4500 Ea6500 Firmware Ea6500 Ea6400 Firmware Ea6400 E4200V2 Firmware E4200V2 Ea6300 Firmware Ea6300 Ea6900 Firmware Ea6900 Ea2700 Firmware Ea2700 Ea3500 Firmware Ea3500 Ea6200 Firmware Ea6200 Ea6700 Firmware Ea6700

3.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:A/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:A/AC:L/Au:N/C:P/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 01, 2014 - 10:55 cve.org

LOW 3.3

DescriptionCVE.org

Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain the administrator's MD5 password hash via a direct request for the /.htpasswd URI.

AnalysisAI

Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300,. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain the administrator's MD5 password hash via a direct request for the /.htpasswd URI. Affected products include: Linksys Ea4500 Firmware, Linksys Ea4500, Linksys Ea6500 Firmware, Linksys Ea6500, Linksys Ea6400 Firmware. Version information: before 2.1.41.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.