CVE-2014-5409 GE Hydran M2 Predictable Value Range from Previous Values
Remote attackers can spoof packets on GE Hydran M2 devices by predicting weak TCP Initial Sequence Numbers generated by the Ethernet card.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-5409?
CVE-2014-5409 is a medium-severity vulnerability in GE Hydran M2, containing the 17046 Ethernet option, published on 14 Mar 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.
Weakness: CWE-343
Which versions are affected by CVE-2014-5409?
It affects 1 product.
Products include Ge Hydran M2.
How do I fix CVE-2014-5409?
No fix has been published for CVE-2014-5409 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-5409 being exploited?
There is no known exploitation of CVE-2014-5409 in the wild and no public exploit code.
Sources
Also known as GHSA-w7hr-2cw5-qqgq.