Details of VAR-201409-0187

ID

VAR-201409-0187

CVE

CVE-2014-2379

TITLE

Sensys Networks VSN240 Sensor VDS and TrafficDOT Vulnerable to traffic control

Trust: 0.8

sources: JVNDB: JVNDB-2014-004067

DESCRIPTION

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network. Sensys Networks VSN240-F and VSN240-T sensors have security vulnerabilities in versions prior to VDS 2.10.1 and versions prior to TrafficDOT 2.10.3. Because the program does not use encryption. Multiple Sensys Networks Products are prone to a security vulnerability that allows attackers to perform man-in-the-middle attacks. Remote attackers can exploit this issue to gain access to sensitive information through a man-in-the-middle attack. Successful exploits will lead to other attacks

Trust: 2.43

sources: NVD: CVE-2014-2379 // JVNDB: JVNDB-2014-004067 // CNVD: CNVD-2014-05491 // BID: 69644

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2014-05491

AFFECTED PRODUCTS

vendor:	sensysnetworks	model:	trafficdot	scope:	eq	version:	2.10.1	Trust: 1.6
vendor:	sensysnetworks	model:	vds	scope:	eq	version:	1.8.7	Trust: 1.6
vendor:	sensysnetworks	model:	vds	scope:	eq	version:	2.6.4	Trust: 1.6
vendor:	sensysnetworks	model:	trafficdot	scope:	eq	version:	2.10.0	Trust: 1.6
vendor:	sensysnetworks	model:	vds	scope:	eq	version:	1.8.5	Trust: 1.6
vendor:	sensysnetworks	model:	trafficdot	scope:	eq	version:	2.8.3	Trust: 1.6
vendor:	sensysnetworks	model:	vds	scope:	eq	version:	2.6.3	Trust: 1.6
vendor:	sensys	model:	vsn240-f	scope:	-	version:	-	Trust: 1.4
vendor:	sensys	model:	trafficdot	scope:	lt	version:	2.10.3	Trust: 1.4
vendor:	sensysnetworks	model:	vsn240-t	scope:	eq	version:	-	Trust: 1.0
vendor:	sensysnetworks	model:	trafficdot	scope:	lte	version:	2.10.2	Trust: 1.0
vendor:	sensysnetworks	model:	vsn240-f	scope:	eq	version:	-	Trust: 1.0
vendor:	sensysnetworks	model:	vds	scope:	lte	version:	2.10.0	Trust: 1.0
vendor:	sensys	model:	vds	scope:	lt	version:	2.10.1	Trust: 0.8
vendor:	sensys	model:	vsn240-t	scope:	-	version:	-	Trust: 0.8
vendor:	sensys	model:	vsn240-t sensors vds	scope:	lt	version:	2.10.1	Trust: 0.6
vendor:	sensysnetworks	model:	trafficdot	scope:	eq	version:	2.10.2	Trust: 0.6
vendor:	sensysnetworks	model:	vds	scope:	eq	version:	2.10.0	Trust: 0.6

sources: CNVD: CNVD-2014-05491 // CNNVD: CNNVD-201409-052 // JVNDB: JVNDB-2014-004067 // NVD: CVE-2014-2379

CVSS

SEVERITY

CVSSV2

CVSSV3

ics-cert@hq.dhs.gov:	CVE-2014-2379
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2014-2379
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-2379
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2014-05491
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201409-052
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2014-2379
severity:	MEDIUM
baseScore:	5.4
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
ics-cert@hq.dhs.gov:	CVE-2014-2379
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:A/AC:H/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.2
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
CNVD:	CNVD-2014-05491
severity:	MEDIUM
baseScore:	5.4
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2014-05491 // CNNVD: CNNVD-201409-052 // JVNDB: JVNDB-2014-004067 // NVD: CVE-2014-2379 // NVD: CVE-2014-2379

PROBLEMTYPE DATA

problemtype:	CWE-310	Trust: 1.8
problemtype:	CWE-311	Trust: 1.0

sources: JVNDB: JVNDB-2014-004067 // NVD: CVE-2014-2379

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201409-052

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201409-052

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-004067

PATCH

title:	Channel Partner Resources by Category	url:	http://www.sensysnetworks.com/resources-by-category/	Trust: 0.8
title:	Multiple patches for Sensys Networks product man-in-the-middle exploits	url:	https://www.cnvd.org.cn/patchInfo/show/49790	Trust: 0.6

sources: CNVD: CNVD-2014-05491 // JVNDB: JVNDB-2014-004067

EXTERNAL IDS

db:	NVD	id:	CVE-2014-2379	Trust: 3.3
db:	ICS CERT	id:	ICSA-14-247-01	Trust: 3.0
db:	ICS CERT	id:	ICSA-14-247-01A	Trust: 1.0
db:	BID	id:	69644	Trust: 0.9
db:	JVNDB	id:	JVNDB-2014-004067	Trust: 0.8
db:	CNVD	id:	CNVD-2014-05491	Trust: 0.6
db:	CNNVD	id:	CNNVD-201409-052	Trust: 0.6

sources: CNVD: CNVD-2014-05491 // BID: 69644 // CNNVD: CNNVD-201409-052 // JVNDB: JVNDB-2014-004067 // NVD: CVE-2014-2379

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-14-247-01	Trust: 3.0
url:	https://www.cisa.gov/news-events/ics-advisories/icsa-14-247-01a	Trust: 1.0
url:	http://www.sensysnetworks.com/resources-by-category/#sw	Trust: 1.0
url:	http://www.sensysnetworks.com/distributors/	Trust: 1.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2379	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2379	Trust: 0.8
url:	http://www.securityfocus.com/bid/69644	Trust: 0.6

sources: CNVD: CNVD-2014-05491 // CNNVD: CNNVD-201409-052 // JVNDB: JVNDB-2014-004067 // NVD: CVE-2014-2379

CREDITS

Cesar Cerrudo of IOActive

Trust: 0.3

sources: BID: 69644

SOURCES

db:	CNVD	id:	CNVD-2014-05491
db:	BID	id:	69644
db:	CNNVD	id:	CNNVD-201409-052
db:	JVNDB	id:	JVNDB-2014-004067
db:	NVD	id:	CVE-2014-2379

LAST UPDATE DATE

2025-10-15T23:47:41.005000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2014-05491	date:	2014-09-10T00:00:00
db:	BID	id:	69644	date:	2014-10-30T01:58:00
db:	CNNVD	id:	CNNVD-201409-052	date:	2014-09-09T00:00:00
db:	JVNDB	id:	JVNDB-2014-004067	date:	2014-09-09T00:00:00
db:	NVD	id:	CVE-2014-2379	date:	2025-10-13T23:15:35.540

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2014-05491	date:	2014-09-10T00:00:00
db:	BID	id:	69644	date:	2014-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201409-052	date:	2014-09-09T00:00:00
db:	JVNDB	id:	JVNDB-2014-004067	date:	2014-09-09T00:00:00
db:	NVD	id:	CVE-2014-2379	date:	2014-09-05T17:55:06.547