CVE-2014-9596 Weak cryptography in n/a
Remote attackers can sniff unencrypted network traffic to steal Active Directory credentials when specific wireless features are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-9596?
CVE-2014-9596 is a medium-severity vulnerability in n/a, published on 15 Jan 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Panasonic Arbitrator Back-End Server (BES) MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive information by sniffing the network for client-server traffic, as demonstrated by Active Directory credential information.
Weakness: CWE-310
Which versions are affected by CVE-2014-9596?
It affects 4 products.
Products include Panasonic Arbitrator Back-End Server Mk 2.0 Vpu, Panasonic Arbitrator Back-End Server Mk 2.0 Vpu Firmware, Panasonic Arbitrator Back-End Server Mk 3.0 Vpu, Panasonic Arbitrator Back-End Server Mk 3.0 Vpu Firmware.
How do I fix CVE-2014-9596?
No fix has been published for CVE-2014-9596 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-9596 being exploited?
There is no known exploitation of CVE-2014-9596 in the wild and no public exploit code.
Sources
Also known as GHSA-g5q6-q8j3-6m3c.