CVE-2014-9196 : Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates T

Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.

Published 2015-07-20 01:59:01

Updated 2016-11-28 19:13:45

Source ICS-CERT

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2014-9196

EPSS FAQ

0.44%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-9196

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2014-9196

https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01

Eaton’s Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet Vulnerability | CISA
Third Party Advisory;US Government Resource
http://www.securityfocus.com/bid/75936

Multiple Eaton Cooper Power Systems Products Man in The Middle Security Bypass Vulnerability

Products affected by CVE-2014-9196

Eaton » Proview » Version: 5.0.1
cpe:2.3:a:eaton:proview:5.0.1:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.2
cpe:2.3:a:eaton:proview:5.0.2:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.10
cpe:2.3:a:eaton:proview:5.0.10:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.6
cpe:2.3:a:eaton:proview:5.0.6:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.7
cpe:2.3:a:eaton:proview:5.0.7:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.3
cpe:2.3:a:eaton:proview:5.0.3:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.4
cpe:2.3:a:eaton:proview:5.0.4:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.5
cpe:2.3:a:eaton:proview:5.0.5:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 4.0
cpe:2.3:a:eaton:proview:4.0:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0
cpe:2.3:a:eaton:proview:5.0:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.8
cpe:2.3:a:eaton:proview:5.0.8:*:*:*:*:*:*:*
Matching versions
Eaton » Proview » Version: 5.0.9
cpe:2.3:a:eaton:proview:5.0.9:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2014-9196

Exploit prediction scoring system (EPSS) score for CVE-2014-9196

CVSS scores for CVE-2014-9196

CWE ids for CVE-2014-9196

References for CVE-2014-9196

Products affected by CVE-2014-9196