variot - var-201411-0419

VAR-201411-0419

Vulnerability from variot - Updated: 2023-12-18 13:29

Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. LANTIME M-Series servers are prone to an unspecified cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. LANTIME M-Series 6.15.019 and prior are vulnerable. Meinberg Radio Clocks LANTIME M-Series Servers is an NTP server (computer time synchronization) product of the LANTIME M series of Meinberg Radio Clocks in Germany

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201411-0419",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ntp server",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "meinberg",
        "version": null
      },
      {
        "model": "lantime m600",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "meinberg",
        "version": "6.15.0.19"
      },
      {
        "model": "lantime m900",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "meinberg",
        "version": "6.15.0.19"
      },
      {
        "model": "lantime m400",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "meinberg",
        "version": "6.15.0.19"
      },
      {
        "model": "lantime m100",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "meinberg",
        "version": "6.15.0.19"
      },
      {
        "model": "lantime m300",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "meinberg",
        "version": "6.15.0.19"
      },
      {
        "model": "lantime m200",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "meinberg",
        "version": "6.15.0.19"
      },
      {
        "model": "lantime m3000",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "meinberg",
        "version": "6.15.0.19"
      },
      {
        "model": "lantime m100",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": "6.15.019"
      },
      {
        "model": "lantime m200",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": "6.15.019"
      },
      {
        "model": "lantime m300",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": "6.15.019"
      },
      {
        "model": "lantime m3000",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": "6.15.019"
      },
      {
        "model": "lantime m400",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": "6.15.019"
      },
      {
        "model": "lantime m600",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": "6.15.019"
      },
      {
        "model": "lantime m900",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": "6.15.019"
      },
      {
        "model": "ntp server",
        "scope": null,
        "trust": 0.8,
        "vendor": "meinberg funkuhren",
        "version": null
      },
      {
        "model": "radio clocks lantime m-series",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "meinberg",
        "version": "6.15.19"
      },
      {
        "model": "radio clocks lantime m-series",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "meinberg",
        "version": "6.15.20"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "70847"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:meinberg:ntp_server_firmware:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:meinberg:lantime_m600:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.15.0.19",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:meinberg:lantime_m900:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.15.0.19",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:meinberg:lantime_m3000:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.15.0.19",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:meinberg:lantime_m100:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.15.0.19",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:meinberg:lantime_m300:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.15.0.19",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:meinberg:lantime_m200:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.15.0.19",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:meinberg:lantime_m400:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "6.15.0.19",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Aivar Liimets",
    "sources": [
      {
        "db": "BID",
        "id": "70847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2014-5417",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2014-5417",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-73358",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2014-5417",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201411-004",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-73358",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-73358"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. LANTIME M-Series servers are prone to an unspecified cross-site scripting vulnerability. \nAn attacker may leverage this issue to execute arbitrary script code  in the browser of an unsuspecting user in the context of the affected  site. This can allow the attacker to steal cookie-based authentication  credentials and launch other attacks. \nLANTIME M-Series 6.15.019 and prior are vulnerable. Meinberg Radio Clocks LANTIME M-Series Servers is an NTP server (computer time synchronization) product of the LANTIME M series of Meinberg Radio Clocks in Germany",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "db": "BID",
        "id": "70847"
      },
      {
        "db": "VULHUB",
        "id": "VHN-73358"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "ICS CERT",
        "id": "ICSA-14-275-01",
        "trust": 2.8
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5417",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "70847",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-73358",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-73358"
      },
      {
        "db": "BID",
        "id": "70847"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ]
  },
  "id": "VAR-201411-0419",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-73358"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:29:39.424000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "LANTIME M100",
        "trust": 0.8,
        "url": "http://www.meinberg.de/german/products/din-rail-ntp-server.htm"
      },
      {
        "title": "LANTIME M200",
        "trust": 0.8,
        "url": "http://www.meinbergglobal.com/english/products/compact-ntp-server.htm"
      },
      {
        "title": "LANTIME M300",
        "trust": 0.8,
        "url": "http://www.meinbergglobal.com/english/products/rack-mount-1u-ntp-server.htm"
      },
      {
        "title": "LANTIME M400",
        "trust": 0.8,
        "url": "http://www.meinbergglobal.com/english/products/advanced-rail-mount-ntp-server.htm"
      },
      {
        "title": "LANTIME M600",
        "trust": 0.8,
        "url": "http://www.meinbergglobal.com/english/products/advanced-1u-ntp-server.htm"
      },
      {
        "title": "LANTIME M900",
        "trust": 0.8,
        "url": "http://www.meinbergglobal.com/english/products/modular-ntp-time-server-platform.htm"
      },
      {
        "title": "LANTIME M3000",
        "trust": 0.8,
        "url": "http://www.meinbergglobal.com/english/products/modular-sync-server.htm"
      },
      {
        "title": "[MBGSA-1404] LANTIME Web Interface Cross Site Scripting Vulnerability",
        "trust": 0.8,
        "url": "http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1404-lantime-web-interface-cross-site-scripting-vulnerability.htm"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-73358"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.8,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-14-275-01"
      },
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/70847"
      },
      {
        "trust": 1.7,
        "url": "http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1404-lantime-web-interface-cross-site-scripting-vulnerability.htm"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5417"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5417"
      },
      {
        "trust": 0.3,
        "url": "http://www.meinbergglobal.com/english/products/ntp-time-server.htm"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-73358"
      },
      {
        "db": "BID",
        "id": "70847"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-73358"
      },
      {
        "db": "BID",
        "id": "70847"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-11-05T00:00:00",
        "db": "VULHUB",
        "id": "VHN-73358"
      },
      {
        "date": "2014-10-30T00:00:00",
        "db": "BID",
        "id": "70847"
      },
      {
        "date": "2014-11-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "date": "2014-11-05T11:55:06.827000",
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "date": "2014-10-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2015-08-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-73358"
      },
      {
        "date": "2014-10-30T00:00:00",
        "db": "BID",
        "id": "70847"
      },
      {
        "date": "2014-11-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      },
      {
        "date": "2015-08-06T15:05:48.070000",
        "db": "NVD",
        "id": "CVE-2014-5417"
      },
      {
        "date": "2014-11-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "LANTIME M-Series Runs on the device  Meinberg NTP Server firmware cross-site scripting vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-005258"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201411-004"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-5417 (GCVE-0-2014-5417)

Vulnerability from cvelistv5 – Published: 2014-11-05 11:00 – Updated: 2025-11-04 23:19

Title

Meinberg Radio Clocks LANTIME M-Series

Summary

Severity ?

No CVSS data available.

CWE

Assigner

icscert

References

URL

Tags

	http://www.securityfocus.com/bid/70847	vdb-entryx_refsource_BID
	https://www.cisa.gov/news-events/ics-advisories/i…
	http://www.meinbergglobal.com/english/news/meinbe…	x_refsource_CONFIRM
	https://github.com/cisagov/CSAF/blob/develop/csaf…
	http://news.meinberg.de/259

Impacted products

	Vendor	Product	Version
	Meinberg Radio Clocks	LANTIME M-Series	Affected: 0 , ≤ 6.15.019 (custom) Unaffected: 6.15.020

Credits

Martem Telecontrol Systems security researcher Aivar Liimets

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:49.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "70847",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70847"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-275-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1404-lantime-web-interface-cross-site-scripting-vulnerability.htm"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LANTIME M-Series",
          "vendor": "Meinberg Radio Clocks",
          "versions": [
            {
              "lessThanOrEqual": "6.15.019",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "6.15.020"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Martem Telecontrol Systems security researcher Aivar Liimets"
        }
      ],
      "datePublic": "2014-10-30T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.\u003c/p\u003e"
            }
          ],
          "value": "Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-04T23:19:36.651Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "70847",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70847"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-275-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1404-lantime-web-interface-cross-site-scripting-vulnerability.htm"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-275-01.json"
        },
        {
          "url": "http://news.meinberg.de/259"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMeinberg\u2019s firmware update, Version 6.15.020, resolves this vulnerability.\u003c/p\u003e\n\u003cp\u003ePlease contact Meinberg customer service for information on how to \ndownload and install the firmware update, or obtain the update at the \nfollowing online location:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://news.meinberg.de/259\"\u003ehttp://news.meinberg.de/259\u003c/a\u003e\u003c/p\u003eMeinberg \u2013 Radio Clocks\u003cbr\u003eLange Wand 9\u003cbr\u003eD-31812 Bad Pyrmont\u003cbr\u003ePhone: ++49(0)5281-9309 0\u003cbr\u003eFax: ++49(0)5281-9309 30\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.meinberg.de/\"\u003ehttp:www.meinberg.de\u003c/a\u003e\u003cbr\u003eEmail: info@meinberg.de\n\n\u003cbr\u003e"
            }
          ],
          "value": "Meinberg\u2019s firmware update, Version 6.15.020, resolves this vulnerability.\n\n\nPlease contact Meinberg customer service for information on how to \ndownload and install the firmware update, or obtain the update at the \nfollowing online location:\n\n\n http://news.meinberg.de/259 \n\nMeinberg \u2013 Radio Clocks\nLange Wand 9\nD-31812 Bad Pyrmont\nPhone: ++49(0)5281-9309 0\nFax: ++49(0)5281-9309 30\n http:www.meinberg.de http://www.meinberg.de/ \nEmail: info@meinberg.de"
        }
      ],
      "source": {
        "advisory": "ICSA-14-275-01",
        "discovery": "EXTERNAL"
      },
      "title": "Meinberg Radio Clocks LANTIME M-Series",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-5417",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "70847",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70847"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-14-275-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-275-01"
            },
            {
              "name": "http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1404-lantime-web-interface-cross-site-scripting-vulnerability.htm",
              "refsource": "CONFIRM",
              "url": "http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1404-lantime-web-interface-cross-site-scripting-vulnerability.htm"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-5417",
    "datePublished": "2014-11-05T11:00:00",
    "dateReserved": "2014-08-22T00:00:00",
    "dateUpdated": "2025-11-04T23:19:36.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201411-0419

CVE-2014-5417 (GCVE-0-2014-5417)

Tags

Sightings

Nomenclature