FKIE_CVE-2014-9196
Vulnerability from fkie_nvd - Published: 2015-07-20 01:59 - Updated: 2025-09-05 21:15
Severity ?
Summary
Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:eaton:proview:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "09E9D87B-D0F2-48DD-97F1-9CB5D7B319E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BD294C06-DCE8-45B1-A59E-E45CB50CA089",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91712733-5783-4B9A-8BD8-62A32229BC03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDCAC23C-22B9-4862-A967-453812EEAA3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "91DEAC57-6765-4470-963E-E9EC364657AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "955879A7-9F8F-47F2-B8F0-7D62AB69261D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "ADF48CE1-EC38-4F11-82D1-514C993AF1FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B9705072-55EE-46E6-B124-8C7A20D6DC03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "04909702-7055-4822-BAB8-139EBF4E409C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7484B7D1-D109-4E5E-B26F-4FEB88E68EB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E64750AD-BAA4-4837-BA51-87019A585C91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:eaton:proview:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5BFA9727-CBCA-45BC-B4BA-0B5730C05450",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value."
},
{
"lang": "es",
"value": "\u0027ulnerabilidad en Eaton Cooper Power Systems ProView en las versiones 4.0 y 5.0 anterior a la 5.0 11 Form 6 controles e Idea e IdeaPLUS relay genera un n\u00famero TCP inicial de secuencia (ISN) de valores lineales, lo que hace que sea m\u00e1s f\u00e1cil para los atacantes remotos falsificar las sesiones TCP al predecir un valor ISN."
}
],
"id": "CVE-2014-9196",
"lastModified": "2025-09-05T21:15:33.743",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary",
"userInteractionRequired": false
},
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-07-20T01:59:01.113",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"url": "http://www.securityfocus.com/bid/75936"
},
{
"source": "ics-cert@hq.dhs.gov",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-006-01"
},
{
"source": "ics-cert@hq.dhs.gov",
"url": "https://www.eaton.com/cybersecurity"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/75936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-342"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…