What is the CVSS score of CVE-2014-9583?

CVE-2014-9583 has a CVSS 2.0 base score of 10.0 (Critical). CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 91.0%.

Is there a public PoC exploit available for CVE-2014-9583?

Yes, a public proof-of-concept exploit is available for CVE-2014-9583. Prioritise patching immediately. EPSS: 91.0%.

Tm Ac1900 CVE-2014-9583

CRITICAL

Permissions, Privileges, and Access Controls (CWE-264)

2015-01-08 cve@mitre.org

Privilege Escalation Tm Ac1900 Wrt Firmware

10.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:C/I:C/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jan 08, 2015 - 20:59 cve.org

CRITICAL 10.0

DescriptionCVE.org

common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999. NOTE: this issue was incorrectly mapped to CVE-2014-10000, but that ID is invalid due to its use as an example of the 2014 CVE ID syntax change.

AnalysisAI

common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 91.0%.

Technical ContextAI

This vulnerability is classified under CWE-264. common.c in infosvr in ASUS WRT firmware 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and other versions, as used in RT-AC66U, RT-N66U, and other routers, does not properly check the MAC address for a request, which allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999. NOTE: this issue was incorrectly mapped to CVE-2014-10000, but that ID is invalid due to its use as an example of the 2014 CVE ID syntax change. Affected products include: T-Mobile Tm-Ac1900, Asus Wrt Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.