Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2014-8389 Details

Description

cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html CVEExploitMitigationThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2015/Jul/29 CVEExploitMailing ListMitigationThird Party Advisory
https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection CVEExploitMitigationTechnical DescriptionThird Party Advisory
http://www.securityfocus.com/archive/1/535938/100/0/threaded CVE
http://www.securityfocus.com/bid/75559 CVEExploitMitigationThird Party AdvisoryVDB Entry

see all 10 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')[email protected]

Affected Products

ProductVersions

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2014-8389
NVD Published Date:
Dec 28, 2017
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2014-8389 Details - Not Deferred