1. CVE-Search
  2. CVE-2014-2046
ID CVE-2014-2046
Summary cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allows remote attackers to (1) obtain credentials and other sensitive information via a certain request to the config.getValuesHashExcludePaths method or (2) modify the firmware via unspecified vectors.
References
Vulnerable Configurations
  • cpe:2.3:a:broadcom:pipa_c211_web_interface:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:broadcom:pipa_c211_web_interface:1.1:*:*:*:*:*:*:*
  • cpe:2.3:h:broadcom:pipa_c211:-:rev2:*:*:*:*:*:*
    cpe:2.3:h:broadcom:pipa_c211:-:rev2:*:*:*:*:*:*
CVSS
Base: 9.7 (as of 14-05-2014 - 18:55)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:C/A:C
refmap via4
fulldisc 20140513 CVE-2014-2046 - Unauthenticated Credential And Configuration Retrieval In Broadcom Ltd PIPA C211
misc https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2046/
Last major update 14-05-2014 - 18:55
Published 14-05-2014 - 00:55
Last modified 14-05-2014 - 18:55
Back to Top