CVE-2018-14494 — CRITICAL (9.8)

Vulnerability Description

Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, although this CVE was first populated in July 2019, it is a historical vulnerability that does not apply to any current or recent Vivotek hardware or firmware

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Vivotek	Fd8136 Firmware	0301a
Vivotek	Fd8136	-

Related Weaknesses (CWE)

CWE-78

References

https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selectThird Party Advisory
https://www.vdalabs.com/2018/08/06/professional-iot-hacking-series-hunting-remotThird Party Advisory
https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-selectThird Party Advisory
https://www.vdalabs.com/2018/08/06/professional-iot-hacking-series-hunting-remotThird Party Advisory

FAQ

What is CVE-2018-14494?

CVE-2018-14494 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, although this CVE was first populated in July 2...

How severe is CVE-2018-14494?

CVE-2018-14494 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-14494?

Check the references section above for vendor advisories and patch information. Affected products include: Vivotek Fd8136 Firmware, Vivotek Fd8136.