CVE-2014-125001 Cardo Systems Scala Rider Q3 Cardo-Updater api privileges management
Unauthenticated attackers can execute arbitrary code with root privileges on Cardo Systems Scala Rider Q3 devices via the Cardo-Updater API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-125001?
CVE-2014-125001 is a high-severity authentication bypass vulnerability in Cardo Systems Scala Rider Q3, published on 24 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended.
Weakness: CWE-269
Which versions are affected by CVE-2014-125001?
It affects 1 product.
Products include Cardosystems Scala Rider Q3 Firmware.
How do I fix CVE-2014-125001?
No fix has been published for CVE-2014-125001 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2014-125001 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-125001 exists.
Sources
Also known as GHSA-mhp5-2jm9-qw86.