CVE-2014-7249 Memory corruption in n/a
Remote attackers can execute arbitrary code on Allied Telesis network devices via a crafted HTTP POST request due to a buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-7249?
CVE-2014-7249 is a critical memory corruption vulnerability in n/a, published on 19 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 9924SP, CentreCOM 9924T/4SP, Rapier 48i, and SwitchBlade4000 with firmware before 2.9.1-21 allows remote attackers to execute arbitrary code via a crafted HTTP POST request.
Weakness: CWE-119
Which versions are affected by CVE-2014-7249?
It affects 48 products.
Products include Alliedtelesis Ar440s, Alliedtelesis Ar440s Firmware, Alliedtelesis Ar441s, Alliedtelesis Ar441s Firmware, Alliedtelesis Ar442s, Alliedtelesis Ar442s Firmware and 42 more.
How do I fix CVE-2014-7249?
No fix has been published for CVE-2014-7249 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2014-7249 being exploited?
There is no known exploitation of CVE-2014-7249 in the wild and no public exploit code.
Sources
Also known as GHSA-r2p3-v7r6-vhc6.