FKIE_CVE-2014-2940

Vulnerability from fkie_nvd - Published: 2014-08-15 11:15 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access.
References
cret@cert.orghttp://www.kb.cert.org/vuls/id/460687Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/460687Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
cobham sailor_900_firmware 1.08_mfhf
cobham sailor_900_firmware 2.11_vhf
cobham sailor_900_vsat -
cobham sailor_6000_series_firmware 1.08_mfhf
cobham sailor_6000_series_firmware 2.11_vhf
cobham ailor_6110_mini-c_gmdss -
cobham sailor_6006_message_terminal -
cobham sailor_6222_vhf -
cobham sailor_6300_mf_\/_hf -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cobham:sailor_900_firmware:1.08_mfhf:*:*:*:*:*:*:*",
              "matchCriteriaId": "63D4B0A2-4B55-4262-A505-1FA798BD83AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cobham:sailor_900_firmware:2.11_vhf:*:*:*:*:*:*:*",
              "matchCriteriaId": "89C816D4-46C7-4E22-A01C-EB3F0B5AA0E3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cobham:sailor_900_vsat:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7704EFE7-FCF8-4109-AE65-B162604E0025",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cobham:sailor_6000_series_firmware:1.08_mfhf:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1A7D4EA-0BAB-446D-BDF9-88432B3504EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cobham:sailor_6000_series_firmware:2.11_vhf:*:*:*:*:*:*:*",
              "matchCriteriaId": "12E7C8AE-0F1F-4EC1-8D27-52DDBC60E609",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cobham:ailor_6110_mini-c_gmdss:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEA4C870-472D-4CE8-BAF7-B489DA48AC4E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cobham:sailor_6006_message_terminal:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D85C2D45-B835-4374-B3AB-B3DE311BBFFA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cobham:sailor_6222_vhf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6CDFC3D-35A7-4530-A253-62E5DF82F3CD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cobham:sailor_6300_mf_\\/_hf:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0328B479-A9BA-49A9-B352-70D8816F4463",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access."
    },
    {
      "lang": "es",
      "value": "Los terminales de sat\u00e9lite Cobham Sailor 900 y 6000 con firmware 1.08 MFHF y 2.11 VHF tienen las credenciales embebidas para la cuenta del administrador, lo que permite a atacantes obtener el control administrativo mediante el aprovechamiento del acceso f\u00edsico o acceso al terminal."
    }
  ],
  "evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/798.html\"\u003eCWE-798: Use of Hard-coded Credentials\u003c/a\u003e",
  "id": "CVE-2014-2940",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-08-15T11:15:42.950",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/460687"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/460687"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.