Vulnerability-Lookup

VAR-201409-0187

Vulnerability from variot - Updated: 2023-12-18 13:29

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network. Sensys Networks VSN240-F and VSN240-T sensors have security vulnerabilities in versions prior to VDS 2.10.1 and versions prior to TrafficDOT 2.10.3. Because the program does not use encryption. Multiple Sensys Networks Products are prone to a security vulnerability that allows attackers to perform man-in-the-middle attacks. Remote attackers can exploit this issue to gain access to sensitive information through a man-in-the-middle attack. Successful exploits will lead to other attacks

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201409-0187",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "vds",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sensysnetworks",
        "version": "1.8.5"
      },
      {
        "model": "trafficdot",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sensysnetworks",
        "version": "2.10.0"
      },
      {
        "model": "vds",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sensysnetworks",
        "version": "1.8.7"
      },
      {
        "model": "vds",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sensysnetworks",
        "version": "2.6.3"
      },
      {
        "model": "vds",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sensysnetworks",
        "version": "2.6.4"
      },
      {
        "model": "trafficdot",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sensysnetworks",
        "version": "2.10.1"
      },
      {
        "model": "trafficdot",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sensysnetworks",
        "version": "2.8.3"
      },
      {
        "model": "vsn240-f",
        "scope": null,
        "trust": 1.4,
        "vendor": "sensys",
        "version": null
      },
      {
        "model": "trafficdot",
        "scope": "lt",
        "trust": 1.4,
        "vendor": "sensys",
        "version": "2.10.3"
      },
      {
        "model": "vsn240-f",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sensysnetworks",
        "version": null
      },
      {
        "model": "vds",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sensysnetworks",
        "version": "2.10.0"
      },
      {
        "model": "trafficdot",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "sensysnetworks",
        "version": "2.10.2"
      },
      {
        "model": "vsn240-t",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sensysnetworks",
        "version": null
      },
      {
        "model": "vds",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "sensys",
        "version": "2.10.1"
      },
      {
        "model": "vsn240-t",
        "scope": null,
        "trust": 0.8,
        "vendor": "sensys",
        "version": null
      },
      {
        "model": "vsn240-t sensors vds",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "sensys",
        "version": "2.10.1"
      },
      {
        "model": "trafficdot",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sensysnetworks",
        "version": "2.10.2"
      },
      {
        "model": "vds",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "sensysnetworks",
        "version": "2.10.0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:trafficdot:2.10.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:trafficdot:2.10.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:trafficdot:2.8.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:trafficdot:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "2.10.2",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:sensysnetworks:vsn240-t:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:sensysnetworks:vsn240-f:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:vds:1.8.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:vds:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "2.10.0",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:vds:2.6.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:vds:2.6.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sensysnetworks:vds:1.8.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:sensysnetworks:vsn240-t:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:sensysnetworks:vsn240-f:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cesar Cerrudo of IOActive",
    "sources": [
      {
        "db": "BID",
        "id": "69644"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-2379",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 5.5,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Adjacent Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.4,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2014-2379",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 5.5,
            "id": "CNVD-2014-05491",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-2379",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-05491",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201409-052",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network. Sensys Networks VSN240-F and VSN240-T sensors have security vulnerabilities in versions prior to VDS 2.10.1 and versions prior to TrafficDOT 2.10.3. Because the program does not use encryption. Multiple Sensys Networks Products are prone to a security vulnerability that allows attackers to perform man-in-the-middle attacks. \nRemote attackers can exploit this issue to gain access to sensitive information through a man-in-the-middle attack. Successful exploits will lead to other attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "db": "BID",
        "id": "69644"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-2379",
        "trust": 3.3
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-247-01",
        "trust": 3.0
      },
      {
        "db": "BID",
        "id": "69644",
        "trust": 0.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "db": "BID",
        "id": "69644"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ]
  },
  "id": "VAR-201409-0187",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      }
    ],
    "trust": 1.3638889
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      }
    ]
  },
  "last_update_date": "2023-12-18T13:29:43.605000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Channel Partner Resources by Category",
        "trust": 0.8,
        "url": "http://www.sensysnetworks.com/resources-by-category/"
      },
      {
        "title": "Multiple patches for Sensys Networks product man-in-the-middle exploits",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/49790"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-310",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.0,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-14-247-01"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2379"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2379"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/69644"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "db": "BID",
        "id": "69644"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-09-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "date": "2014-09-05T00:00:00",
        "db": "BID",
        "id": "69644"
      },
      {
        "date": "2014-09-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "date": "2014-09-05T17:55:06.547000",
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "date": "2014-09-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-09-10T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-05491"
      },
      {
        "date": "2014-10-30T01:58:00",
        "db": "BID",
        "id": "69644"
      },
      {
        "date": "2014-09-09T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      },
      {
        "date": "2014-09-08T15:09:13.800000",
        "db": "NVD",
        "id": "CVE-2014-2379"
      },
      {
        "date": "2014-09-09T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "specific network environment",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Sensys Networks VSN240 Sensor  VDS and  TrafficDOT Vulnerable to traffic control",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-004067"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201409-052"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-2379 (GCVE-0-2014-2379)

Vulnerability from cvelistv5 – Published: 2014-09-05 17:00 – Updated: 2025-10-13 23:02

Title

Sensys Networks Traffic Sensor Missing Encryption of Sensitive Data

Summary

Severity

No CVSS data available.

CWE

CWE-311

Assigner

icscert icscert root Scorecard

References

4 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
http://www.sensysnetworks.com/resources-by-category/#sw
http://www.sensysnetworks.com/distributors/
https://ics-cert.us-cert.gov/advisories/ICSA-14-247-01	x_refsource_MISCx_transferred

Impacted products

2 products

Vendor	Product	Version
Sensys Networks	VSN240-F	Affected: 0 , < VDS 2.10.1 (custom) Affected: 0 , < VDS 1.8.8 (custom) Affected: 0 , < TrafficDOT 2.10.3 (custom)
Sensys Networks	VSN240-T	Affected: 0 , < VDS 2.10.1 (custom) Affected: 0 , < VDS 1.8.8 (custom) Affected: 0 , < TrafficDOT 2.10.3 (custom)

Date Public

2014-09-04 06:00

Credits

Cesar Cerrudo of IOActive

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:14:25.982Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-247-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "VSN240-F",
          "vendor": "Sensys Networks",
          "versions": [
            {
              "lessThan": "VDS 2.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "VDS 1.8.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "TrafficDOT 2.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "VSN240-T",
          "vendor": "Sensys Networks",
          "versions": [
            {
              "lessThan": "VDS 2.10.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "VDS 1.8.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "TrafficDOT 2.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cesar Cerrudo of IOActive"
        }
      ],
      "datePublic": "2014-09-04T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network."
            }
          ],
          "value": "Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "HIGH",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-311",
              "description": "CWE-311",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-13T23:02:57.689Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-247-01a"
        },
        {
          "url": "http://www.sensysnetworks.com/resources-by-category/#sw"
        },
        {
          "url": "http://www.sensysnetworks.com/distributors/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSensys Networks has produced updated product versions VDS 2.10.1 and \nTrafficDOT 2.10.3 to remediate vulnerabilities identified in their \nVSN240-F and VSN240-T traffic sensors.\u003cbr\u003e\u003c/p\u003e\n\n\u003cp\u003eSensys Networks has released software update VDS 1.8.8, for an older \nmodel access point, to remediate traffic sensor vulnerabilities.\u003c/p\u003e\n\u003cp\u003eThe updated human-machine interface version, TrafficDOT 2.10.3, \nenables encrypted software downloads for sensors and sensor data \nauthentication for access points and access point controller cards using\n updated versions VDS 2.10.1 or VDS 1.8.8.\u003cbr\u003e\u003c/p\u003e\n\n\u003cp\u003eAdditional information about Sensys Networks\u2019 software releases can be found at the following location:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.sensysnetworks.com/resources-by-category/#sw\"\u003ehttp://www.sensysnetworks.com/resources-by-category/#sw\u003c/a\u003e\u003c/p\u003e\u003cp\u003eUpdated\n product versions are available through Sensys Networks\u2019 local \ndistributors. Contact information for their local distributors can be \nfound at the following location:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.sensysnetworks.com/distributors/\"\u003ehttp://www.sensysnetworks.com/distributors/\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Sensys Networks has produced updated product versions VDS 2.10.1 and \nTrafficDOT 2.10.3 to remediate vulnerabilities identified in their \nVSN240-F and VSN240-T traffic sensors.\n\n\n\n\nSensys Networks has released software update VDS 1.8.8, for an older \nmodel access point, to remediate traffic sensor vulnerabilities.\n\n\nThe updated human-machine interface version, TrafficDOT 2.10.3, \nenables encrypted software downloads for sensors and sensor data \nauthentication for access points and access point controller cards using\n updated versions VDS 2.10.1 or VDS 1.8.8.\n\n\n\n\nAdditional information about Sensys Networks\u2019 software releases can be found at the following location:\n\n\n http://www.sensysnetworks.com/resources-by-category/#sw \n\nUpdated\n product versions are available through Sensys Networks\u2019 local \ndistributors. Contact information for their local distributors can be \nfound at the following location:\n\n\n http://www.sensysnetworks.com/distributors/"
        }
      ],
      "source": {
        "advisory": "ICSA-14-247-01",
        "discovery": "EXTERNAL"
      },
      "title": "Sensys Networks Traffic Sensor Missing Encryption of Sensitive Data",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-2378",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-14-247-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-247-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-2379",
    "datePublished": "2014-09-05T17:00:00.000Z",
    "dateReserved": "2014-03-13T00:00:00.000Z",
    "dateUpdated": "2025-10-13T23:02:57.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

VAR-201409-0187

CVE-2014-2379 (GCVE-0-2014-2379)

Tags

Sightings

Nomenclature

Related by attack behaviour