Vulnerability Description
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows remote attackers to perform a replay attack.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Viprinet | Multichannel Vpn Router 300 Firmware | 2013070830 |
| Viprinet | Multichannel Vpn Router 300 | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/8Mailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/537441/100/0/threaded
- http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/8Mailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/537441/100/0/threaded
FAQ
What is CVE-2014-9755?
CVE-2014-9755 is a vulnerability with a CVSS score of 7.5 (HIGH). The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before ...
How severe is CVE-2014-9755?
CVE-2014-9755 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9755?
Check the references section above for vendor advisories and patch information. Affected products include: Viprinet Multichannel Vpn Router 300 Firmware, Viprinet Multichannel Vpn Router 300.