CVE-2014-2377 Ecava IntegraXor SCADA Server Information Exposure Through Environmental Variables

MediumCVSS 5.0 EPSS 1.8%

Published: 2014-09-15 17:00
Updated: 2026-06-17 03:06
Exploit status: No public exploit known

Description

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

Affected products

Product	Affected versions	Fixed in
ecava integraxor	<= 4.1.4360	No fix listed
ecava integraxor	<= 4.1.4392	No fix listed
ecava IntegraXor SCADA Server	<= v4.1.4360	No fix listed
ecava IntegraXor SCADA Server	<= v4.1.4392	No fix listed

References

www.cisa.gov
ics-cert.us-cert.gov third-party-advisory us-government-resource

CVSS v2.0

5.0 Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

All scores (3)

v2.0 5.0 · nvd@nist.gov
v2.0 5.0 · icscert
v2.0 5.0 · ics-cert@hq.dhs.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.84% (percentile 79.3)
CWE: CWE-200 CWE-526

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.