CVE-2017-14009 Information disclosure in ProMinent MultiFLEX M10a Controller
An authenticated attacker can view the current user password in plaintext via the Change Password feature, leading to credential exposure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-14009?
CVE-2017-14009 is a medium-severity vulnerability in ProMinent MultiFLEX M10a Controller, published on 17 Oct 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature on the application, the current password for the user is specified in plaintext. This may allow an attacker who has been authenticated to gain access to the password.
Which versions are affected by CVE-2017-14009?
It affects 1 product.
Products include Prominent Multiflex M10a Controller Firmware.
How do I fix CVE-2017-14009?
No fix has been published for CVE-2017-14009 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-14009 being exploited?
There is no known exploitation of CVE-2017-14009 in the wild and no public exploit code.
Other vulnerabilities in ProMinent MultiFLEX M10a Controller
Sources
Also known as GHSA-hwf3-jmw4-9hxh.