CVE-2014-2361

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-320

Affected software

Vendor	Product	Versions
OleumTech	WIO DH2 Wireless Gateway	All versions
OleumTech	Sensor Wireless I/O Modules	All versions

References

http://support.oleumtech.com/
http://www.securityfocus.com/bid/68797
https://www.cisa.gov/news-events/ics-advisories/icsa-14-202-01a
http://ics-cert.us-cert.gov/advisories/ICSA-14-202-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/68795

Timeline

Published: Jul 24, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-23627.8OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which mak CVE-2014-236310.0Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login req CVE-2014-23647.5Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string i CVE-2014-23655.5Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknow CVE-2014-23664.0upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.CVE-2014-23674.3The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to CVE-2014-23685.0The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files vi CVE-2014-23696.0Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8 CVE-2014-23703.5Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x al CVE-2014-23737.5The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings vi CVE-2014-23747.5The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings vi CVE-2014-23759.0Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrar