VulnerabilityModified
CVE-2014-0328
The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures, which allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response.
HIGH 9.3EPSS 2.76%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures, which allows attackers to execute arbitrary code by leveraging physical access or terminal access to send an SNMP request and a TFTP response.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 2.76% probability · 85th percentile
- CISA KEV
- Not listed
- Affected
- cobham/ailor 6110 mini-c gmdss · cobham/sailor 6006 message terminal · cobham/sailor 6222 vhf · cobham/sailor 6300 mf \/ hf
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/179732Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/179732Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.