CVE-2014-9754 The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before....
MediumCVSS 5.9
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| viprinet multichannel vpn router 300 firmware | = 2013070830 | No fix listed |
| viprinet multichannel vpn router 300 firmware | = 2013080900 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160203 Security Advisories mailing-list third-party-advisory
- 20160203 Security Advisories mailing-list