Search
Find a vulnerability
Search criteria
12 vulnerabilities by Raritan
GCVE-1988-2026-0506
Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
EPSS
VEX
Title
[0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in the
Raritan PX3 PDU G4, firmware version 4.3.14, the intelligent rack power
distribution unit from Raritan, a Legrand company (United States). A
low-privilege authenticated session converts one diagnostics request into
operating-system command execution in the product's web-service context,
because the hostname validation that is supposed to gate the ping and
traceroute commands produces the correct rejection verdict and the caller then
executes on it anyway.
Type and root cause. CWE-78, OS command injection, with CWE-20 co-equal,
in the diagnostics service of /lib/libisys.so.1.0. The firmware is an aarch64
embedded Linux image whose web tier is a custom 1.8 MB C++ daemon, /bin/httpd,
built on an IDL-RPC framework: an authentication subsystem the binary refers
to as pp::aaa, a JSON-RPC name service, and seventy-five service namespaces,
all behind per-method authentication. The two diagnostics implementations,
isys::net::diag::ping at 0x5a988 and isys::net::diag::traceRoute at 0x5ab64,
do not perform network operations themselves: they assemble shell command
strings from the operator-supplied hostname and execute them through /bin/sh,
via pp::BackgroundCommand::open(bgCmd, "/bin/sh", argv) at 0x36170, reached
through runShellCommandAndGetResults() at 0x36094, which logs the command it
is about to run. The templates are ping -c <count> -W <timeout> <HOST> 2>&1
and traceroute -w <timeout> -m 30 <HOST> 2>&1, with ping6 and traceroute6
variants; the neighbouring string table carries "ping", "ping6", "traceroute",
"traceroute6", "2>&1" and the source file name "DiagnosticsImpl.cpp".
The defect is a returned verdict consumed with the wrong comparison. The
validation function, validateAndResolveHostName() at 0x5a3f4, is not a stub:
it walks the hostname character by character, explicitly rejects the percent
sign and every character above the ASCII colon, cross-checks that the host
resolves through the resolver service, and returns one constant, three, on
every rejection path - the rejection block converges at the load of that
constant and returns at 0x5a54c. Both consumers evaluate the verdict with an
unsigned strictly-greater branch: a return of three is not strictly greater
than three, so it falls through, and the rejected hostname is spliced into the
shell template verbatim. The result is an injection whose success condition is
the validator working exactly as designed: a semicolon is caught by the
character loop, a dollar or parenthesis survives the loop but fails
resolution, and all of them - caught or unresolved - flow into the command
template. A host value of 1.1.1.1;id>/tmp/marker;# keeps the ping segment
syntactically complete, runs the injected statement as a second shell
statement, and the trailing hash comments out the template's 2>&1 suffix; the
subshell form and a newline-separated form ride the same rejection path; the
traceroute template arms the second entry point identically. The image
contains a strict fully-qualified-hostname validator in libnetwork.so, but
the web daemon does not import it and the diagnostics library neither links
nor loads it on this code path.
The request that reaches the sink looks like this, transmitted as one JSON
body over the authenticated RPC channel:
```
{
"jsonrpc": "2.0",
"method": "net.Diagnostics.ping",
"params": {
"host": "1.1.1.1;id>/tmp/marker;#",
"count": 1,
"timeout": 1
},
"id": 2
}
```
The same attacker string rides the hostname argument of the corresponding CLI
commands. The 2>&1 merge suffix is an amplifier the attacker inherits for
free: whatever the injected command prints on either stream is captured by the
same mechanism that returns ping output, so the response channel doubles as
the command-output channel and no out-of-band exfiltration is needed.
Reach and privileges. The web methods sit behind the framework's per-method
authentication and no bypass of that boundary was measured. The load-bearing
privilege artifact is the shipped CLI configuration, /etc/clish/netdiag.xml:
ping and traceroute are defined with no access attribute - available to every
authenticated CLI user in this framework's grammar - while the neighbouring
netstat command carries access="admin". The vendor's own artifact therefore
documents that these two functions were deliberately placed in the
all-authenticated-users class, presumably on the theory that a ping is
harmless. On a rack PDU, management is a network service at a datacenter's
softest point, and the finding's effective audience is every monitoring
account, operations automation role and integration credential granted "just
to poll".
Severity. The published score is 8.8 High,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: ISS = 1 - (1 - 0.56) x (1 -
0.56) x (1 - 0.56) = 0.914816, impact = 6.42 x 0.914816 = 5.869119,
exploitability = 8.22 x 0.85 x 0.77 x 0.62 x 0.85 = 2.835255, base =
5.869119 + 2.835255 = 8.704374, rounded up to 8.8. A PR:N reading of 9.8
Critical (impact 5.869119 plus exploitability 3.887043, total 9.756162) is
rejected: no authentication bypass was measured. Two conditional readings are
published as explicitly labelled conditionals and never as the headline. The
first applies where a deployment still carries the factory default
administrative credential pair recorded in the image's configuration default
area for first-boot access: the same PR:N vector computes to 9.8 Critical for
the chain of that adjacent weakness plus this injection, and a changed
credential removes it; the default pair is disclosed as a separate weakness
and is not folded into the published vector. The second applies only to
deployments in which no low-privilege account is provisioned and every caller
holds administrator privileges: the PR:H vector computes to 7.2 High
(exploitability 1.234708 plus 5.869119, total 7.103826), and it is not the
headline because the vendor's own shipped CLI artifact grants diagnostics to
all authenticated users.
Verification method, and its boundary. Every static claim is measured from the
firmware image at instruction level: the templates, the character loop, the
converging rejection blocks, the consumers' compare-and-branch sequences, the
shell open, and the two import facts. The dynamic layer is a command-level
replication of the recovered sink semantics on an isolated research host: the
exact reconstructed templates were executed through a shell under the
semicolon, subshell and traceroute injection shapes, and each produced the
marker command's output, while a metacharacter-free control produced nothing
and the marker path was confirmed absent afterwards. What was not done: no
end-to-end exploitation through the management interface of a physical unit.
No physical unit was available, and full-system emulation was blocked by the
management daemon's dependency on the configuration daemon and the flash
storage layer, which an image-only extraction does not provide. Appliance-side
execution identity was therefore not measured at runtime and is not claimed;
the replication's shell ran under the research host's privileged account,
which is a property of the research environment, and the published claims are
written against the web service's account, whichever that is.
Impact. One authenticated request converts into command execution in the
process context of the web management daemon, with command output returned
through the same response channel. The service's read reach includes the
product's configuration and state stores, so configuration data, recorded
credentials and network information can be exfiltrated in the same channel
that ping output arrives in. Both methods accept repeated calls with fresh
hostnames, so staging, reading results and cleanup are one request each, and
no persistence inside the product is needed. On a power distribution product,
availability is the physical machine state: the injected command executes in
the daemon that hosts the outlet control surface, so the ability to cycle
outlet power, and thereby hard-stop, every machine fed by the unit, follows
from the product's own function. That consequence is a labelled inference.
sink level was measured. Detection is poor by construction: the triggering
request is a legitimate diagnostics call that the product logs as the
assembled shell command, and the strongest available signal is shell-command
log review for the two templates.
Remediation, in the order that removes the class: perform ping and traceroute
without a shell, through their library or raw-socket interfaces or an
argv-array spawn, which removes the CWE-78 class from this handler entirely;
correct the verdict consumption - accept only the documented success returns
and reject everything else - as a one-line containment that can ship
immediately; centralize hostname admission for both entry channels on a
literal-or-strict-name allow-list that runs before any command text is
assembled, using the strict validator already present in the image; audit
every other consumer of the shared validation function for the same
strictly-greater consumption of the rejection constant; remove the factory
default credential and force a first-login change, which closes the
conditional unauthenticated chain; add injection regression suites for both
channels covering the full character-class table; and make the shell-template
log line an alertable event. Operator measures until firmware is fixed: change
the factory default immediately, restrict management access to the operations
network, prefer monitoring roles that need no diagnostics, and alert on
diagnostics shell lines whose host segment is not a literal address or strict
name.
Proof of concept. The published tool is a standard-library-only Python 3
client that drives the entry path against an explicit target with explicit
credentials or a pre-established session token, a configurable command and
explicit timeouts; it attempts the two candidate session-establishment routes
observed in this framework generation's front ends and degrades to a supplied
token, and it embeds no addresses, credentials or state of the verification
environment. Safety rails: loopback default, no persistence steps, one
non-destructive marker command by default, and no configuration change beyond
what the described request performs. Use it only against systems you own or
are authorised to test.
The vendor's parent company product security team, whose signed RFC 9116
contact file on the parent's primary web host names the intake mailbox used,
was notified through that documented security mailbox, which is the only
channel used; no security intake of the router brand itself exists, no
pre-publication intake form was submitted, and no individual was addressed by
name. This disclosure is unconditional: the research is published, no
permission was asked for, no embargo was requested, nothing is withheld
pending a reply, and remediation questions are answered at no cost. No
vulnerability identifier has been assigned to this finding.
Full technical analysis and the reproducible proof of concept, published
unconditionally:
https://0day-rubbish.com/blog/raritan-px3-pdu-g4-diag-ping-traceroute-command-injection
Project archive (ongoing disclosure series):
https://github.com/Exploit-Garbage/0day-Rubbish
--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "PX3 PDU",
"vendor": "Raritan",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in the\nRaritan PX3 PDU G4, firmware version 4.3.14, the intelligent rack power\ndistribution unit from Raritan, a Legrand company (United States). A\nlow-privilege authenticated session converts one diagnostics request into\noperating-system command execution in the product\u0027s web-service context,\nbecause the hostname validation that is supposed to gate the ping and\ntraceroute commands produces the correct rejection verdict and the caller then\nexecutes on it anyway.\n\nType and root cause. CWE-78, OS command injection, with CWE-20 co-equal,\nin the diagnostics service of /lib/libisys.so.1.0. The firmware is an aarch64\nembedded Linux image whose web tier is a custom 1.8 MB C++ daemon, /bin/httpd,\nbuilt on an IDL-RPC framework: an authentication subsystem the binary refers\nto as pp::aaa, a JSON-RPC name service, and seventy-five service namespaces,\nall behind per-method authentication. The two diagnostics implementations,\nisys::net::diag::ping at 0x5a988 and isys::net::diag::traceRoute at 0x5ab64,\ndo not perform network operations themselves: they assemble shell command\nstrings from the operator-supplied hostname and execute them through /bin/sh,\nvia pp::BackgroundCommand::open(bgCmd, \"/bin/sh\", argv) at 0x36170, reached\nthrough runShellCommandAndGetResults() at 0x36094, which logs the command it\nis about to run. The templates are ping -c \u003ccount\u003e -W \u003ctimeout\u003e \u003cHOST\u003e 2\u003e\u00261\nand traceroute -w \u003ctimeout\u003e -m 30 \u003cHOST\u003e 2\u003e\u00261, with ping6 and traceroute6\nvariants; the neighbouring string table carries \"ping\", \"ping6\", \"traceroute\",\n\"traceroute6\", \"2\u003e\u00261\" and the source file name \"DiagnosticsImpl.cpp\".\n\nThe defect is a returned verdict consumed with the wrong comparison. The\nvalidation function, validateAndResolveHostName() at 0x5a3f4, is not a stub:\nit walks the hostname character by character, explicitly rejects the percent\nsign and every character above the ASCII colon, cross-checks that the host\nresolves through the resolver service, and returns one constant, three, on\nevery rejection path - the rejection block converges at the load of that\nconstant and returns at 0x5a54c. Both consumers evaluate the verdict with an\nunsigned strictly-greater branch: a return of three is not strictly greater\nthan three, so it falls through, and the rejected hostname is spliced into the\nshell template verbatim. The result is an injection whose success condition is\nthe validator working exactly as designed: a semicolon is caught by the\ncharacter loop, a dollar or parenthesis survives the loop but fails\nresolution, and all of them - caught or unresolved - flow into the command\ntemplate. A host value of 1.1.1.1;id\u003e/tmp/marker;# keeps the ping segment\nsyntactically complete, runs the injected statement as a second shell\nstatement, and the trailing hash comments out the template\u0027s 2\u003e\u00261 suffix; the\nsubshell form and a newline-separated form ride the same rejection path; the\ntraceroute template arms the second entry point identically. The image\ncontains a strict fully-qualified-hostname validator in libnetwork.so, but\nthe web daemon does not import it and the diagnostics library neither links\nnor loads it on this code path.\n\nThe request that reaches the sink looks like this, transmitted as one JSON\nbody over the authenticated RPC channel:\n\n```\n{\n \"jsonrpc\": \"2.0\",\n \"method\": \"net.Diagnostics.ping\",\n \"params\": {\n \"host\": \"1.1.1.1;id\u003e/tmp/marker;#\",\n \"count\": 1,\n \"timeout\": 1\n },\n \"id\": 2\n}\n```\n\nThe same attacker string rides the hostname argument of the corresponding CLI\ncommands. The 2\u003e\u00261 merge suffix is an amplifier the attacker inherits for\nfree: whatever the injected command prints on either stream is captured by the\nsame mechanism that returns ping output, so the response channel doubles as\nthe command-output channel and no out-of-band exfiltration is needed.\n\nReach and privileges. The web methods sit behind the framework\u0027s per-method\nauthentication and no bypass of that boundary was measured. The load-bearing\nprivilege artifact is the shipped CLI configuration, /etc/clish/netdiag.xml:\nping and traceroute are defined with no access attribute - available to every\nauthenticated CLI user in this framework\u0027s grammar - while the neighbouring\nnetstat command carries access=\"admin\". The vendor\u0027s own artifact therefore\ndocuments that these two functions were deliberately placed in the\nall-authenticated-users class, presumably on the theory that a ping is\nharmless. On a rack PDU, management is a network service at a datacenter\u0027s\nsoftest point, and the finding\u0027s effective audience is every monitoring\naccount, operations automation role and integration credential granted \"just\nto poll\".\n\nSeverity. The published score is 8.8 High,\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: ISS = 1 - (1 - 0.56) x (1 -\n0.56) x (1 - 0.56) = 0.914816, impact = 6.42 x 0.914816 = 5.869119,\nexploitability = 8.22 x 0.85 x 0.77 x 0.62 x 0.85 = 2.835255, base =\n5.869119 + 2.835255 = 8.704374, rounded up to 8.8. A PR:N reading of 9.8\nCritical (impact 5.869119 plus exploitability 3.887043, total 9.756162) is\nrejected: no authentication bypass was measured. Two conditional readings are\npublished as explicitly labelled conditionals and never as the headline. The\nfirst applies where a deployment still carries the factory default\nadministrative credential pair recorded in the image\u0027s configuration default\narea for first-boot access: the same PR:N vector computes to 9.8 Critical for\nthe chain of that adjacent weakness plus this injection, and a changed\ncredential removes it; the default pair is disclosed as a separate weakness\nand is not folded into the published vector. The second applies only to\ndeployments in which no low-privilege account is provisioned and every caller\nholds administrator privileges: the PR:H vector computes to 7.2 High\n(exploitability 1.234708 plus 5.869119, total 7.103826), and it is not the\nheadline because the vendor\u0027s own shipped CLI artifact grants diagnostics to\nall authenticated users.\n\nVerification method, and its boundary. Every static claim is measured from the\nfirmware image at instruction level: the templates, the character loop, the\nconverging rejection blocks, the consumers\u0027 compare-and-branch sequences, the\nshell open, and the two import facts. The dynamic layer is a command-level\nreplication of the recovered sink semantics on an isolated research host: the\nexact reconstructed templates were executed through a shell under the\nsemicolon, subshell and traceroute injection shapes, and each produced the\nmarker command\u0027s output, while a metacharacter-free control produced nothing\nand the marker path was confirmed absent afterwards. What was not done: no\nend-to-end exploitation through the management interface of a physical unit.\nNo physical unit was available, and full-system emulation was blocked by the\nmanagement daemon\u0027s dependency on the configuration daemon and the flash\nstorage layer, which an image-only extraction does not provide. Appliance-side\nexecution identity was therefore not measured at runtime and is not claimed;\nthe replication\u0027s shell ran under the research host\u0027s privileged account,\nwhich is a property of the research environment, and the published claims are\nwritten against the web service\u0027s account, whichever that is.\n\nImpact. One authenticated request converts into command execution in the\nprocess context of the web management daemon, with command output returned\nthrough the same response channel. The service\u0027s read reach includes the\nproduct\u0027s configuration and state stores, so configuration data, recorded\ncredentials and network information can be exfiltrated in the same channel\nthat ping output arrives in. Both methods accept repeated calls with fresh\nhostnames, so staging, reading results and cleanup are one request each, and\nno persistence inside the product is needed. On a power distribution product,\navailability is the physical machine state: the injected command executes in\nthe daemon that hosts the outlet control surface, so the ability to cycle\noutlet power, and thereby hard-stop, every machine fed by the unit, follows\nfrom the product\u0027s own function. That consequence is a labelled inference.\nsink level was measured. Detection is poor by construction: the triggering\nrequest is a legitimate diagnostics call that the product logs as the\nassembled shell command, and the strongest available signal is shell-command\nlog review for the two templates.\n\nRemediation, in the order that removes the class: perform ping and traceroute\nwithout a shell, through their library or raw-socket interfaces or an\nargv-array spawn, which removes the CWE-78 class from this handler entirely;\ncorrect the verdict consumption - accept only the documented success returns\nand reject everything else - as a one-line containment that can ship\nimmediately; centralize hostname admission for both entry channels on a\nliteral-or-strict-name allow-list that runs before any command text is\nassembled, using the strict validator already present in the image; audit\nevery other consumer of the shared validation function for the same\nstrictly-greater consumption of the rejection constant; remove the factory\ndefault credential and force a first-login change, which closes the\nconditional unauthenticated chain; add injection regression suites for both\nchannels covering the full character-class table; and make the shell-template\nlog line an alertable event. Operator measures until firmware is fixed: change\nthe factory default immediately, restrict management access to the operations\nnetwork, prefer monitoring roles that need no diagnostics, and alert on\ndiagnostics shell lines whose host segment is not a literal address or strict\nname.\n\nProof of concept. The published tool is a standard-library-only Python 3\nclient that drives the entry path against an explicit target with explicit\ncredentials or a pre-established session token, a configurable command and\nexplicit timeouts; it attempts the two candidate session-establishment routes\nobserved in this framework generation\u0027s front ends and degrades to a supplied\ntoken, and it embeds no addresses, credentials or state of the verification\nenvironment. Safety rails: loopback default, no persistence steps, one\nnon-destructive marker command by default, and no configuration change beyond\nwhat the described request performs. Use it only against systems you own or\nare authorised to test.\n\nThe vendor\u0027s parent company product security team, whose signed RFC 9116\ncontact file on the parent\u0027s primary web host names the intake mailbox used,\nwas notified through that documented security mailbox, which is the only\nchannel used; no security intake of the router brand itself exists, no\npre-publication intake form was submitted, and no individual was addressed by\nname. This disclosure is unconditional: the research is published, no\npermission was asked for, no embargo was requested, nothing is withheld\npending a reply, and remediation questions are answered at no cost. No\nvulnerability identifier has been assigned to this finding.\n\nFull technical analysis and the reproducible proof of concept, published\nunconditionally:\n https://0day-rubbish.com/blog/raritan-px3-pdu-g4-diag-ping-traceroute-command-injection\n\nProject archive (ongoing disclosure series):\n https://github.com/Exploit-Garbage/0day-Rubbish\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T07:30:04Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/54"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Oct/54"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/raritan-px3-pdu-g4-diag-ping-traceroute-command-injection"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Oct/54"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0506",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/54",
"automated": true,
"contentSha256": "8ab1603aae2c30145f46927eb66bc545f561770746543a7428d7f853ae26dd52",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/54",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-10-27T16:39:44Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T07:30:04Z",
"dateUpdated": "2026-11-02T07:30:04Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0506"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0140
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:53
VLAI
EPSS
VEX
Title
[0day-rubbish] Raritan EMX firmware emx_ecx_3.6.1_46982 (EMX/ECX gateway) Authenticated config injection to root RCE (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Raritan EMX firmware emx_ecx_3.6.1_46982 (EMX/ECX
gateway).
Type: Authenticated config injection to root RCE (CWE-74)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Impact: Full root compromise of the PDU management gateway, placing power telemetry and rack power infrastructure under
attacker control.
Authentication: authenticated (requires valid session)
Full technical analysis and a reproducible proof-of-concept:
https://0day-rubbish.com/blog/raritan-emx-port-mux-proto-listener-root-rce
Project archive (ongoing disclosure series):
https://github.com/Exploit-Garbage/0day-Rubbish
Vendor has been notified. CVE ID is pending.
--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Raritan | EMX firmware |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "EMX firmware",
"vendor": "Raritan",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "disclosure via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Raritan EMX firmware emx_ecx_3.6.1_46982 (EMX/ECX \ngateway).\n\nType: Authenticated config injection to root RCE (CWE-74)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)\nImpact: Full root compromise of the PDU management gateway, placing power telemetry and rack power infrastructure under \nattacker control.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n https://0day-rubbish.com/blog/raritan-emx-port-mux-proto-listener-root-rce\n\nProject archive (ongoing disclosure series):\n https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:53:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/99"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/99"
},
{
"url": "https://0day-rubbish.com"
},
{
"url": "https://0day-rubbish.com/blog/raritan-emx-port-mux-proto-listener-root-rce"
},
{
"url": "https://github.com/Exploit-Garbage/0day-Rubbish"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/99"
],
"discovery": "EXTERNAL"
},
"title": "[0day-rubbish] Raritan EMX firmware emx_ecx_3.6.1_46982 (EMX/ECX gateway) Authenticated config injection to root RCE (8.8)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0140",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/99",
"automated": true,
"contentSha256": "00c43c8a6d54a41f04a27f367791d95383a29e678222adec66111ad535cde16b",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/99",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-25T17:12:05Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:22Z",
"dateUpdated": "2026-09-11T11:53:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0140"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-201408-0318
Vulnerability from variot - Updated: 2025-04-13 23:39Raritan Japan Dominion KX2-101 switches before 2 allow remote attackers to cause a denial of service (device hang) via a crafted packet. Dominion KX2-101 provided by Raritan Japan, Inc. contains a denial-of-service (DoS) vulnerability. Dominion KX2-101 provided by Raritan Japan, Inc. is a KVM-over-IP switch. Dominion KX2-101 contains a denial-of-service (DoS) vulnerability. Yusuke Okano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.By receiving a specially crafted packet, the product may be forced to stop responding. Raritan Japan KX2-101 is a switch product from Raritan Corporation of the United States. A denial of service vulnerability exists in Raritan Japan KX2-101. Attackers may leverage this issue to crash the affected device, denying service to legitimate users. Dominion KX2-101 is vulnerable; other versions may also be affected
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201408-0318",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dominion",
"scope": "eq",
"trust": 1.4,
"vendor": "raritan",
"version": "kx2-101"
},
{
"model": "dominion kx ii-101",
"scope": "eq",
"trust": 1.0,
"vendor": "raritan",
"version": null
},
{
"model": "dominion kx2-101",
"scope": "lt",
"trust": 0.6,
"vendor": "raritan",
"version": "2"
},
{
"model": "dominion kx2-101",
"scope": null,
"trust": 0.3,
"vendor": "raritan",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"db": "BID",
"id": "69232"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-225"
},
{
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:raritan:dominion",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Yusuke Okano",
"sources": [
{
"db": "BID",
"id": "69232"
}
],
"trust": 0.3
},
"cve": "CVE-2014-3901",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2014-3901",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 7.8,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2014-000097",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-05051",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-71841",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-3901",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2014-000097",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-05051",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201408-225",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-71841",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"db": "VULHUB",
"id": "VHN-71841"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-225"
},
{
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Raritan Japan Dominion KX2-101 switches before 2 allow remote attackers to cause a denial of service (device hang) via a crafted packet. Dominion KX2-101 provided by Raritan Japan, Inc. contains a denial-of-service (DoS) vulnerability. Dominion KX2-101 provided by Raritan Japan, Inc. is a KVM-over-IP switch. Dominion KX2-101 contains a denial-of-service (DoS) vulnerability. Yusuke Okano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.By receiving a specially crafted packet, the product may be forced to stop responding. Raritan Japan KX2-101 is a switch product from Raritan Corporation of the United States. A denial of service vulnerability exists in Raritan Japan KX2-101. \nAttackers may leverage this issue to crash the affected device, denying service to legitimate users. \nDominion KX2-101 is vulnerable; other versions may also be affected",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-3901"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"db": "BID",
"id": "69232"
},
{
"db": "VULHUB",
"id": "VHN-71841"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2014-000097",
"trust": 3.4
},
{
"db": "NVD",
"id": "CVE-2014-3901",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVN07957080",
"trust": 3.4
},
{
"db": "BID",
"id": "69232",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201408-225",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2014-05051",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-71841",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"db": "VULHUB",
"id": "VHN-71841"
},
{
"db": "BID",
"id": "69232"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-225"
},
{
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"id": "VAR-201408-0318",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"db": "VULHUB",
"id": "VHN-71841"
}
],
"trust": 1.45
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05051"
}
]
},
"last_update_date": "2025-04-13T23:39:09.525000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Dominion KX II-101 V2",
"trust": 0.8,
"url": "http://www.raritan.com/products/kvm-switches/dominion-kx-ii-101"
},
{
"title": "Raritan Japan KX2-101 Remediation measures for denial of service vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=234908"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-225"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-20",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://jvn.jp/en/jp/jvn07957080/index.html"
},
{
"trust": 1.7,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2014-000097"
},
{
"trust": 0.9,
"url": "http://jvndb.jvn.jp/en/contents/2014/jvndb-2014-000097.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3901"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3901"
},
{
"trust": 0.3,
"url": ""
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"db": "VULHUB",
"id": "VHN-71841"
},
{
"db": "BID",
"id": "69232"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-225"
},
{
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"db": "VULHUB",
"id": "VHN-71841"
},
{
"db": "BID",
"id": "69232"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"db": "CNNVD",
"id": "CNNVD-201408-225"
},
{
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-08-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"date": "2014-08-12T00:00:00",
"db": "VULHUB",
"id": "VHN-71841"
},
{
"date": "2014-08-12T00:00:00",
"db": "BID",
"id": "69232"
},
{
"date": "2014-08-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"date": "2014-08-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201408-225"
},
{
"date": "2014-08-12T23:55:04.003000",
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-08-15T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-05051"
},
{
"date": "2015-12-04T00:00:00",
"db": "VULHUB",
"id": "VHN-71841"
},
{
"date": "2014-08-12T00:00:00",
"db": "BID",
"id": "69232"
},
{
"date": "2014-08-18T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-000097"
},
{
"date": "2023-04-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201408-225"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-3901"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201408-225"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dominion KX2-101 vulnerable to denial-of-service (DoS)",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-000097"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "69232"
}
],
"trust": 0.3
}
}
VAR-200507-0043
Vulnerability from variot - Updated: 2025-04-03 22:19Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users. Raritan Dominion SX is reportedly prone to multiple vulnerabilities. Reportedly, the server contains two default accounts that are not protected with a password. This can allow a remote attacker to gain unauthorized access to the server. Another issue can allow an attacker to potentially gain elevated privileges on an affected computer as the shadow password file is world readable. Raritan Dominion SX16, SX32, SX4, SX8, and SXA-48 are reportedly vulnerable. The researcher responsible for reporting these issues has stated that DSX32 running firmware version 2.4.6 was tested and is vulnerable to these issues. This BID will be updated when more details are available. Raritan Dominion SX Console Server is a set of serial device management software. Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 have weak security mechanisms.
Bist Du interessiert an einem neuen Job in IT-Sicherheit?
Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/
TITLE: Dominion SX Insecure File Permission Security Issues
SECUNIA ADVISORY ID: SA15853
VERIFY ADVISORY: http://secunia.com/advisories/15853/
CRITICAL: Less critical
IMPACT: Manipulation of data, Exposure of sensitive information
WHERE: Local system
OPERATING SYSTEM: Dominion SX http://secunia.com/product/5300/
DESCRIPTION: Dirk Wetter has reported two security issues in Dominion SX, which can be exploited by malicious, local users to disclose sensitive information, cause a DoS (Denial of Service), and potentially gain escalated privileges.
1) The default file permission of "/etc/shadow" is set to world-readable, which makes it possible to gain knowledge of the root user's password hash.
2) The default file permission of "/bin/busybox" is set to world-writable. This can be exploited to move or delete the file and potentially execute arbitrary code with another user's privileges by replacing it with a malicious file.
The security issues have been reported in DSX4, DSX8, DSX16, DSX32, and DSXA-48.
SOLUTION: Apply updated firmware. http://www.raritan.com/support/sup_upgrades.aspx
PROVIDED AND/OR DISCOVERED BY: Dirk Wetter
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200507-0043",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "dominion sx32",
"scope": "eq",
"trust": 1.3,
"vendor": "raritan",
"version": "2.4.6"
},
{
"model": "dominion sx8",
"scope": "eq",
"trust": 1.0,
"vendor": "raritan",
"version": null
},
{
"model": "dominion sx16",
"scope": "eq",
"trust": 1.0,
"vendor": "raritan",
"version": null
},
{
"model": "dominion sxa-48",
"scope": "eq",
"trust": 1.0,
"vendor": "raritan",
"version": null
},
{
"model": "dominion sx4",
"scope": "eq",
"trust": 1.0,
"vendor": "raritan",
"version": null
},
{
"model": "dominion",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "sx32_2.4.6_firmware"
},
{
"model": "dominion",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "sx32"
},
{
"model": "dominion",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "sx8"
},
{
"model": "dominion",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "sxa-48"
},
{
"model": "dominion",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "sx16"
},
{
"model": "dominion",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "sx4"
},
{
"model": "dominion sxa-48",
"scope": null,
"trust": 0.3,
"vendor": "raritan",
"version": null
},
{
"model": "dominion sx8",
"scope": null,
"trust": 0.3,
"vendor": "raritan",
"version": null
},
{
"model": "dominion sx4",
"scope": null,
"trust": 0.3,
"vendor": "raritan",
"version": null
},
{
"model": "dominion sx32",
"scope": null,
"trust": 0.3,
"vendor": "raritan",
"version": null
},
{
"model": "dominion sx16",
"scope": null,
"trust": 0.3,
"vendor": "raritan",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "14084"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
},
{
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Discovery is credited to Dr. Dirk Wetter.",
"sources": [
{
"db": "BID",
"id": "14084"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
}
],
"trust": 0.9
},
"cve": "CVE-2005-2136",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2005-2136",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-13345",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2005-2136",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200507-018",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-13345",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-13345"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
},
{
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set (1) world-readable permissions for /etc/shadow and (2) world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users. Raritan Dominion SX is reportedly prone to multiple vulnerabilities. \nReportedly, the server contains two default accounts that are not protected with a password. This can allow a remote attacker to gain unauthorized access to the server. \nAnother issue can allow an attacker to potentially gain elevated privileges on an affected computer as the shadow password file is world readable. \nRaritan Dominion SX16, SX32, SX4, SX8, and SXA-48 are reportedly vulnerable. The researcher responsible for reporting these issues has stated that DSX32 running firmware version 2.4.6 was tested and is vulnerable to these issues. \nThis BID will be updated when more details are available. Raritan Dominion SX Console Server is a set of serial device management software. Raritan Dominion SX (DSX) Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 have weak security mechanisms. \n\n----------------------------------------------------------------------\n\nBist Du interessiert an einem neuen Job in IT-Sicherheit?\n\n\nSecunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-\nSicherheit:\nhttp://secunia.com/secunia_vacancies/\n\n----------------------------------------------------------------------\n\nTITLE:\nDominion SX Insecure File Permission Security Issues\n\nSECUNIA ADVISORY ID:\nSA15853\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/15853/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nManipulation of data, Exposure of sensitive information\n\nWHERE:\nLocal system\n\nOPERATING SYSTEM:\nDominion SX\nhttp://secunia.com/product/5300/\n\nDESCRIPTION:\nDirk Wetter has reported two security issues in Dominion SX, which\ncan be exploited by malicious, local users to disclose sensitive\ninformation, cause a DoS (Denial of Service), and potentially gain\nescalated privileges. \n\n1) The default file permission of \"/etc/shadow\" is set to\nworld-readable, which makes it possible to gain knowledge of the root\nuser\u0027s password hash. \n\n2) The default file permission of \"/bin/busybox\" is set to\nworld-writable. This can be exploited to move or delete the file and\npotentially execute arbitrary code with another user\u0027s privileges by\nreplacing it with a malicious file. \n\nThe security issues have been reported in DSX4, DSX8, DSX16, DSX32,\nand DSXA-48. \n\nSOLUTION:\nApply updated firmware. \nhttp://www.raritan.com/support/sup_upgrades.aspx\n\nPROVIDED AND/OR DISCOVERED BY:\nDirk Wetter\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2005-2136"
},
{
"db": "BID",
"id": "14084"
},
{
"db": "VULHUB",
"id": "VHN-13345"
},
{
"db": "PACKETSTORM",
"id": "38332"
}
],
"trust": 1.35
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "14084",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "15853",
"trust": 1.8
},
{
"db": "NVD",
"id": "CVE-2005-2136",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-13345",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "38332",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-13345"
},
{
"db": "BID",
"id": "14084"
},
{
"db": "PACKETSTORM",
"id": "38332"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
},
{
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"id": "VAR-200507-0043",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-13345"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-03T22:19:07.027000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Raritan DominionSX ConsoleServer Repair Measures for Weak Security Mechanism Vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=234905"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-863",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/14084"
},
{
"trust": 1.7,
"url": "http://seclists.org/lists/bugtraq/2005/jun/0251.html"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/15853"
},
{
"trust": 0.3,
"url": "http://www.raritan.com/products/serial_console/dominion_sx/dom_sx/prd_cms_index.aspx?currpg=prd_cms_index\u0026name=dominion%20sx\u0026content_category=1\u0026overview_flag=y\u0026features_flag=y\u0026spec_flag=y\u0026support_flag"
},
{
"trust": 0.3,
"url": "/archive/1/403589"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/15853/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5300/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.raritan.com/support/sup_upgrades.aspx"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-13345"
},
{
"db": "BID",
"id": "14084"
},
{
"db": "PACKETSTORM",
"id": "38332"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
},
{
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-13345"
},
{
"db": "BID",
"id": "14084"
},
{
"db": "PACKETSTORM",
"id": "38332"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
},
{
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-07-05T00:00:00",
"db": "VULHUB",
"id": "VHN-13345"
},
{
"date": "2005-06-28T00:00:00",
"db": "BID",
"id": "14084"
},
{
"date": "2005-07-01T04:46:03",
"db": "PACKETSTORM",
"id": "38332"
},
{
"date": "2005-07-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200507-018"
},
{
"date": "2005-07-05T04:00:00",
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-09-05T00:00:00",
"db": "VULHUB",
"id": "VHN-13345"
},
{
"date": "2005-06-28T00:00:00",
"db": "BID",
"id": "14084"
},
{
"date": "2023-04-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200507-018"
},
{
"date": "2025-04-03T01:03:51.193000",
"db": "NVD",
"id": "CVE-2005-2136"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "PACKETSTORM",
"id": "38332"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Raritan DominionSX ConsoleServer Weak security mechanism vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "14084"
},
{
"db": "CNNVD",
"id": "CNNVD-200507-018"
}
],
"trust": 0.9
}
}
VAR-201911-1740
Vulnerability from variot - Updated: 2024-11-23 22:21An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Raritan CommandCenter Secure Gateway Is XML An external entity vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The product provides features such as remote control, centralized authentication, authorization, and logging. A code issue vulnerability exists in Raritan CC-SG versions prior to 8.0.0. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products. I. CVE REFERENCE
CVE-2018-20687
III. VENDOR
https://www.raritan.com/support/product/commandcenter-secure-gateway
IV. TIMELINE
04/01/2019 Vulnerability discovered 07/01/2019 Vendor contacted
V. CREDIT
Okan Coşkun from Biznet Bilisim A.S. Faruk Ünal From Biznet Bilisim A.S.
VI. DESCRIPTION
Raritan CommandCenter Secure Gateway version prior 8.0.0 affected by XXE. A remote unauthenticated attacker may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts by using this vulnerability.
Vulnerable path: /CommandCenterWebServices/.*
VII. SOLUTION
Update current CommandCenter Secure Gateway
VIII. REFERENCES
You can find more information about XXE from the link below: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201911-1740",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "commandcenter secure gateway",
"scope": "lt",
"trust": 1.8,
"vendor": "raritan",
"version": "8.0.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "6.2.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "7.0.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "4.2.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "5.1.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "4.3.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "5.2.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "6.1.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "5.0.5"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "6.0.0"
},
{
"model": "commandcenter secure gateway",
"scope": "eq",
"trust": 0.6,
"vendor": "raritan",
"version": "5.3.0"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
},
{
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:raritan:commandcenter_secure_gateway",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Okan Coskun",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
}
],
"trust": 0.6
},
"cve": "CVE-2018-20687",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-20687",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-131518",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2018-20687",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-20687",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-20687",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2018-20687",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201911-1051",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-131518",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131518"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
},
{
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Raritan CommandCenter Secure Gateway Is XML An external entity vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The product provides features such as remote control, centralized authentication, authorization, and logging. A code issue vulnerability exists in Raritan CC-SG versions prior to 8.0.0. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products. I. CVE REFERENCE\n-------------------------\nCVE-2018-20687\n\nIII. VENDOR\n-------------------------\nhttps://www.raritan.com/support/product/commandcenter-secure-gateway\n\nIV. TIMELINE\n------------------------\n04/01/2019 Vulnerability discovered\n07/01/2019 Vendor contacted\n\nV. CREDIT\n-------------------------\nOkan Co\u015fkun from Biznet Bilisim A.S. \nFaruk \u00dcnal From Biznet Bilisim A.S. \n\nVI. DESCRIPTION\n-------------------------\nRaritan CommandCenter Secure Gateway version prior 8.0.0 affected by\nXXE. A remote unauthenticated attacker may lead to the disclosure of\nconfidential data, denial of service, server side request forgery,\nport scanning from the perspective of the machine where the parser is\nlocated, and other system impacts by using this vulnerability. \n\nVulnerable path: /CommandCenterWebServices/.*\n\nVII. SOLUTION\n-------------------------\nUpdate current CommandCenter Secure Gateway\n\nVIII. REFERENCES\n-------------------------\n\nYou can find more information about XXE from the link below:\nhttps://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-20687"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "VULHUB",
"id": "VHN-131518"
},
{
"db": "PACKETSTORM",
"id": "155359"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-20687",
"trust": 2.6
},
{
"db": "PACKETSTORM",
"id": "155359",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012246",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-131518",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131518"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "PACKETSTORM",
"id": "155359"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
},
{
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"id": "VAR-201911-1740",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-131518"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:21:23.727000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.raritan.com/jp/products/power/dcim-software/power-iq"
},
{
"title": "Raritan CommandCenter Secure Gateway Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=103088"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-611",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131518"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://seclists.org/fulldisclosure/2019/nov/11"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/155359/raritan-commandcenter-secure-gateway-xml-injection.html"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-20687"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-20687"
},
{
"trust": 0.1,
"url": "https://www.raritan.com/support/product/commandcenter-secure-gateway"
},
{
"trust": 0.1,
"url": "https://www.owasp.org/index.php/xml_external_entity_(xxe)_processing"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-131518"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "PACKETSTORM",
"id": "155359"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
},
{
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-131518"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"db": "PACKETSTORM",
"id": "155359"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
},
{
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-11-18T00:00:00",
"db": "VULHUB",
"id": "VHN-131518"
},
{
"date": "2019-11-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"date": "2019-11-15T21:32:42",
"db": "PACKETSTORM",
"id": "155359"
},
{
"date": "2019-11-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-1051"
},
{
"date": "2019-11-18T19:15:12.467000",
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-11-21T00:00:00",
"db": "VULHUB",
"id": "VHN-131518"
},
{
"date": "2019-11-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-012246"
},
{
"date": "2019-12-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-1051"
},
{
"date": "2024-11-21T04:02:00.033000",
"db": "NVD",
"id": "CVE-2018-20687"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "155359"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Raritan CommandCenter Secure Gateway In XML External entity vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012246"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201911-1051"
}
],
"trust": 0.6
}
}
CVE-2018-20687 (GCVE-0-2018-20687)
Vulnerability from nvd – Published: 2019-11-18 18:12 – Updated: 2024-08-05 12:05
VLAI
EPSS
VEX
Summary
An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/155359/Rarit… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/Nov/11 | mailing-listx_refsource_FULLDISC |
Date Public
2019-11-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:05:17.928Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html"
},
{
"name": "20191115 Raritan CommandCenter Secure Gateway XML External Entity \u003c 8.0",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/Nov/11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-18T20:40:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html"
},
{
"name": "20191115 Raritan CommandCenter Secure Gateway XML External Entity \u003c 8.0",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2019/Nov/11"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-20687",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html"
},
{
"name": "20191115 Raritan CommandCenter Secure Gateway XML External Entity \u003c 8.0",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2019/Nov/11"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-20687",
"datePublished": "2019-11-18T18:12:12.000Z",
"dateReserved": "2019-01-10T00:00:00.000Z",
"dateUpdated": "2024-08-05T12:05:17.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-9095 (GCVE-0-2014-9095)
Vulnerability from nvd – Published: 2014-11-26 15:00 – Updated: 2024-08-06 13:33
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/127525/Rarit… | x_refsource_MISC |
| http://secunia.com/advisories/60138 | third-party-advisoryx_refsource_SECUNIA |
| http://seclists.org/fulldisclosure/2014/Jul/79 | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/bid/68722 | vdb-entryx_refsource_BID |
Date Public
2014-07-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:33:13.609Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html"
},
{
"name": "60138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60138"
},
{
"name": "20140717 Raritan PowerIQ v4.10 and v4.2.1 Unauthenticated SQL injection and possible RCE",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/79"
},
{
"name": "68722",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68722"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-07T21:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html"
},
{
"name": "60138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60138"
},
{
"name": "20140717 Raritan PowerIQ v4.10 and v4.2.1 Unauthenticated SQL injection and possible RCE",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/79"
},
{
"name": "68722",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68722"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9095",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html"
},
{
"name": "60138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60138"
},
{
"name": "20140717 Raritan PowerIQ v4.10 and v4.2.1 Unauthenticated SQL injection and possible RCE",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jul/79"
},
{
"name": "68722",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68722"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9095",
"datePublished": "2014-11-26T15:00:00.000Z",
"dateReserved": "2014-11-26T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:33:13.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2955 (GCVE-0-2014-2955)
Vulnerability from nvd – Published: 2014-07-14 21:00 – Updated: 2024-08-06 10:28
VLAI
EPSS
VEX
Summary
Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2014/Jul/14 | mailing-listx_refsource_FULLDISC |
| http://www.kb.cert.org/vuls/id/712660 | third-party-advisoryx_refsource_CERT-VN |
Date Public
2014-07-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:28:46.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140703 Raritan IPMI vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/14"
},
{
"name": "VU#712660",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/712660"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-14T20:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "20140703 Raritan IPMI vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/14"
},
{
"name": "VU#712660",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/712660"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-2955",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140703 Raritan IPMI vulnerability",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jul/14"
},
{
"name": "VU#712660",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/712660"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-2955",
"datePublished": "2014-07-14T21:00:00.000Z",
"dateReserved": "2014-04-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T10:28:46.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-20687 (GCVE-0-2018-20687)
Vulnerability from cvelistv5 – Published: 2019-11-18 18:12 – Updated: 2024-08-05 12:05
VLAI
EPSS
VEX
Summary
An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/155359/Rarit… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2019/Nov/11 | mailing-listx_refsource_FULLDISC |
Date Public
2019-11-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:05:17.928Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html"
},
{
"name": "20191115 Raritan CommandCenter Secure Gateway XML External Entity \u003c 8.0",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/Nov/11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-18T20:40:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html"
},
{
"name": "20191115 Raritan CommandCenter Secure Gateway XML External Entity \u003c 8.0",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2019/Nov/11"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-20687",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/155359/Raritan-CommandCenter-Secure-Gateway-XML-Injection.html"
},
{
"name": "20191115 Raritan CommandCenter Secure Gateway XML External Entity \u003c 8.0",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2019/Nov/11"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-20687",
"datePublished": "2019-11-18T18:12:12.000Z",
"dateReserved": "2019-01-10T00:00:00.000Z",
"dateUpdated": "2024-08-05T12:05:17.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-9095 (GCVE-0-2014-9095)
Vulnerability from cvelistv5 – Published: 2014-11-26 15:00 – Updated: 2024-08-06 13:33
VLAI
EPSS
VEX
Summary
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://packetstormsecurity.com/files/127525/Rarit… | x_refsource_MISC |
| http://secunia.com/advisories/60138 | third-party-advisoryx_refsource_SECUNIA |
| http://seclists.org/fulldisclosure/2014/Jul/79 | mailing-listx_refsource_FULLDISC |
| http://www.securityfocus.com/bid/68722 | vdb-entryx_refsource_BID |
Date Public
2014-07-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:33:13.609Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html"
},
{
"name": "60138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60138"
},
{
"name": "20140717 Raritan PowerIQ v4.10 and v4.2.1 Unauthenticated SQL injection and possible RCE",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/79"
},
{
"name": "68722",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68722"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-07T21:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html"
},
{
"name": "60138",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60138"
},
{
"name": "20140717 Raritan PowerIQ v4.10 and v4.2.1 Unauthenticated SQL injection and possible RCE",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/79"
},
{
"name": "68722",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68722"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9095",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/127525/Raritan-PowerIQ-Unauthenticated-SQL-Injection.html"
},
{
"name": "60138",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60138"
},
{
"name": "20140717 Raritan PowerIQ v4.10 and v4.2.1 Unauthenticated SQL injection and possible RCE",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jul/79"
},
{
"name": "68722",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68722"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9095",
"datePublished": "2014-11-26T15:00:00.000Z",
"dateReserved": "2014-11-26T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:33:13.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2955 (GCVE-0-2014-2955)
Vulnerability from cvelistv5 – Published: 2014-07-14 21:00 – Updated: 2024-08-06 10:28
VLAI
EPSS
VEX
Summary
Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2014/Jul/14 | mailing-listx_refsource_FULLDISC |
| http://www.kb.cert.org/vuls/id/712660 | third-party-advisoryx_refsource_CERT-VN |
Date Public
2014-07-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:28:46.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20140703 Raritan IPMI vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/14"
},
{
"name": "VU#712660",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/712660"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-14T20:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "20140703 Raritan IPMI vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2014/Jul/14"
},
{
"name": "VU#712660",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/712660"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-2955",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20140703 Raritan IPMI vulnerability",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2014/Jul/14"
},
{
"name": "VU#712660",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/712660"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-2955",
"datePublished": "2014-07-14T21:00:00.000Z",
"dateReserved": "2014-04-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T10:28:46.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2014-000097
Vulnerability from jvndb - Published: 2014-08-12 05:03 - Updated:2014-08-18 00:44Summary
Dominion KX2-101 vulnerable to denial-of-service (DoS)
Details
Dominion KX2-101 provided by Raritan Japan, Inc. contains a denial-of-service (DoS) vulnerability.
Dominion KX2-101 provided by Raritan Japan, Inc. is a KVM-over-IP switch. Dominion KX2-101 contains a denial-of-service (DoS) vulnerability.
Yusuke Okano reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000097.html",
"dc:date": "2014-08-18T09:44+09:00",
"dcterms:issued": "2014-08-12T14:03+09:00",
"dcterms:modified": "2014-08-18T09:44+09:00",
"description": "Dominion KX2-101 provided by Raritan Japan, Inc. contains a denial-of-service (DoS) vulnerability.\r\n\r\nDominion KX2-101 provided by Raritan Japan, Inc. is a KVM-over-IP switch. Dominion KX2-101 contains a denial-of-service (DoS) vulnerability.\r\n\r\nYusuke Okano reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000097.html",
"sec:cpe": {
"#text": "cpe:/h:raritan:dominion",
"@product": "Dominion",
"@vendor": "Raritan",
"@version": "2.2"
},
"sec:cvss": {
"@score": "7.8",
"@severity": "High",
"@type": "Base",
"@vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2014-000097",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN07957080/index.html",
"@id": "JVN#07957080",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3901",
"@id": "CVE-2014-3901",
"@source": "CVE"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3901",
"@id": "CVE-2014-3901",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-20",
"@title": "Improper Input Validation(CWE-20)"
}
],
"title": "Dominion KX2-101 vulnerable to denial-of-service (DoS)"
}