CVE-2014-1635

EPSS 67.5%◆ VulnCheck KEV

Vexday Risk Score

72High priority

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 67.5%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

09 May 2014Metasploit module available

06 Nov 2014Public PoC

12 Nov 2014Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

Buffer overflow in login.cgi in MiniHttpd in Belkin N750 Router with firmware before F9K1103_WW_1.10.17m allows remote attackers to execute arbitrary code via a long string in the jump parameter.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencewww.exploit-db.com/exploits/35184unverified exploitdbwww.exploit-db.com/exploits/35184unverified vulncheckvulncheck.com/xdb/f3d43fc6cde3unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/show/osvdb/114345 https://labs.integrity.pt/advisories/cve-2014-1635/https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/http://www.belkin.com/us/support-article?articleNum=4831 http://www.exploit-db.com/exploits/35184 http://www.securityfocus.com/bid/70977 http://www.securitytracker.com/id/1031210