var-201407-0230
Vulnerability from variot

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode. Supplementary information : CWE Vulnerability type by CWE-320: Key Management Errors ( Key management error ) Has been identified. OleumTech is a California company that provides wireless remote monitoring equipment for industrial environments. This key cannot be read remotely when the data system is running. Multiple OleumTech Products are prone to a local security-bypass vulnerability. Attackers with physical access to the device may exploit this issue to bypass certain security restrictions and perform unauthorized actions

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201407-0230",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "sensor wireless i\\/o module",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "oleumtech",
        "version": null
      },
      {
        "model": "wio dh2 wireless gateway",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "oleumtech",
        "version": null
      },
      {
        "model": "wio dh2 wireless gateway",
        "scope": null,
        "trust": 1.4,
        "vendor": "oleumtech",
        "version": null
      },
      {
        "model": "sensor wireless i/o module",
        "scope": null,
        "trust": 0.8,
        "vendor": "oleumtech",
        "version": null
      },
      {
        "model": "sensor wireless i/o modules",
        "scope": null,
        "trust": 0.6,
        "vendor": "oleumtech",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:oleumtech:sensor_wireless_i%2Fo_module",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:oleumtech:wio_dh2_wireless_gateway",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Lucas Apa, and Carlos Mario Penagos Hollman of IOActive.",
    "sources": [
      {
        "db": "BID",
        "id": "68795"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-2361",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2014-2361",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CNVD-2014-04600",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-70300",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-2361",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-2361",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-04600",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201407-593",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-70300",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70300"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode. Supplementary information : CWE Vulnerability type by CWE-320: Key Management Errors ( Key management error ) Has been identified. OleumTech is a California company that provides wireless remote monitoring equipment for industrial environments. This key cannot be read remotely when the data system is running. Multiple OleumTech Products are prone to a local security-bypass vulnerability. \nAttackers with physical access to the device may exploit this issue to  bypass certain security restrictions and perform unauthorized actions",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-2361"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "db": "BID",
        "id": "68795"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70300"
      }
    ],
    "trust": 2.52
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-2361",
        "trust": 3.4
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-202-01",
        "trust": 3.1
      },
      {
        "db": "BID",
        "id": "68795",
        "trust": 2.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-593",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-70300",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70300"
      },
      {
        "db": "BID",
        "id": "68795"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "id": "VAR-201407-0230",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70300"
      }
    ],
    "trust": 1.5125
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      }
    ]
  },
  "last_update_date": "2024-11-23T21:55:19.446000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Wireless I/O Modules",
        "trust": 0.8,
        "url": "http://www.oleumtech.com/index.php?section=product\u0026subsection=product_category\u0026category_id=30"
      },
      {
        "title": "OleumTech WIO DH2 Wireless Gateway",
        "trust": 0.8,
        "url": "http://www.ogesc.com/pdfs/OleumTech/6_dh2-wireless-gateway-datasheet.pdf"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-Other",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "http://ics-cert.us-cert.gov/advisories/icsa-14-202-01"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/68795"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2361"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2361"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70300"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70300"
      },
      {
        "db": "BID",
        "id": "68795"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-07-25T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "date": "2014-07-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-70300"
      },
      {
        "date": "2014-07-21T00:00:00",
        "db": "BID",
        "id": "68795"
      },
      {
        "date": "2014-07-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "date": "2014-07-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      },
      {
        "date": "2014-07-24T14:55:07.190000",
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-07-25T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-04600"
      },
      {
        "date": "2016-11-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-70300"
      },
      {
        "date": "2015-07-15T00:10:00",
        "db": "BID",
        "id": "68795"
      },
      {
        "date": "2014-07-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      },
      {
        "date": "2014-07-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      },
      {
        "date": "2024-11-21T02:06:09",
        "db": "NVD",
        "id": "CVE-2014-2361"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "BID",
        "id": "68795"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-593"
      }
    ],
    "trust": 0.9
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OleumTech WIO DH2 Wireless Gateway and  Sensor Wireless I/O Module Vulnerabilities in which communication is spoofed",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003556"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Design Error",
    "sources": [
      {
        "db": "BID",
        "id": "68795"
      }
    ],
    "trust": 0.3
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.