CVE-2014-2361

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-202-01	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/68795

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:oleumtech:sensor_wireless_i\/o_module:-:::::::*
	cpe:2.3:h:oleumtech:wio_dh2_wireless_gateway:-:::::::*

History

No history.

Information

Published : 2014-07-24 14:55

Updated : 2024-02-04 18:35

NVD link : CVE-2014-2361

Mitre link : CVE-2014-2361

CVE.ORG link : CVE-2014-2361

JSON object : View

Products Affected

oleumtech

sensor_wireless_i\/o_module
wio_dh2_wireless_gateway

CWE

NVD-CWE-Other

{"id": "CVE-2014-2361", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-07-24T14:55:07.190", "references": [{"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-202-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.securityfocus.com/bid/68795", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode."}, {"lang": "es", "value": "OleumTech WIO DH2 Wireless Gateway y Sensor Wireless I/O Modules, cuando BreeZ est\u00e9 utilizado, no requieren la autenticaci\u00f3n para la lectura de la clave de seguridad del sitio, lo que permite a atacantes f\u00edsicamente pr\u00f3ximos falsificar la comunicaci\u00f3n mediante la obtenci\u00f3n de esta clave despu\u00e9s del uso de acceso directo al hardware o el modo de instalaci\u00f3n manual."}], "lastModified": "2016-11-28T19:11:01.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:oleumtech:sensor_wireless_i\\/o_module:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82FA879C-B098-4A44-9036-43854ACBFD50"}, {"criteria": "cpe:2.3:h:oleumtech:wio_dh2_wireless_gateway:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4055E1A3-F159-4B24-926C-578CE8632331"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/320.html\" target=\"_blank\">CWE-320: CWE-320: Key Management Errors</a>\n", "sourceIdentifier": "ics-cert@hq.dhs.gov"}