Vulnerability Description
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Viprinet | Multichannel Vpn Router 300 Firmware | 2013070830 |
| Viprinet | Multichannel Vpn Router 300 | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/8Mailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/537441/100/0/threaded
- http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/8Mailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/537441/100/0/threaded
FAQ
What is CVE-2014-9754?
CVE-2014-9754 is a vulnerability with a CVSS score of 5.9 (MEDIUM). The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before ...
How severe is CVE-2014-9754?
CVE-2014-9754 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9754?
Check the references section above for vendor advisories and patch information. Affected products include: Viprinet Multichannel Vpn Router 300 Firmware, Viprinet Multichannel Vpn Router 300.