Summaryinfo

A vulnerability classified as very critical has been found in Cobham Sailor 900 1.08 Mfhf. This impacts an unknown function of the component Administrator Account. Performing a manipulation results in Remote Code Execution. This vulnerability is cataloged as CVE-2014-2940. There is no exploit available. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability was found in Cobham Sailor 900 1.08 Mfhf. It has been classified as very critical. This affects some unknown processing of the component Administrator Account. The manipulation with an unknown input leads to a remote code execution vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access.

The weakness was shared 08/15/2014 as confirmed advisory (CERT.org). The advisory is shared at kb.cert.org. This vulnerability is uniquely identified as CVE-2014-2940 since 04/21/2014. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/21/2024). MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Cobham

Name

• Sailor 900

Version

• 1.08 Mfhf

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion