CVE Vulnerabilities

CVE-2014-2955

Improper Authentication

Published: Jul 14, 2014 | Modified: Jul 15, 2014
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
10 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

Raritan PX before 1.5.11 on DPXR20A-16 devices allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Px Raritan * 1.5.8
Px Raritan 1.0 1.0
Px Raritan 1.0.4 1.0.4
Px Raritan 1.1 1.1
Px Raritan 1.1.6 1.1.6
Px Raritan 1.2 1.2
Px Raritan 1.2.5 1.2.5
Px Raritan 1.2.7 1.2.7
Px Raritan 1.3 1.3
Px Raritan 1.3.1 1.3.1
Px Raritan 1.3.5 1.3.5
Px Raritan 1.4.1 1.4.1
Px Raritan 1.5 1.5
Px Raritan 1.5.4 1.5.4
Px Raritan 1.5.7 1.5.7

Potential Mitigations

References