CVE-2014-5380

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Grand MA 300 allows retrieval of the access PIN from sniffed data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Aug/70Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/69390Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95484Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2014/Aug/70Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/69390Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95484Third Party Advisory, VDB Entry

Timeline

Published: Jan 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-53819.8Grand MA 300 allows a brute-force attack on the PIN.CVE-2014-53824.3Multiple cross-site scripting (XSS) vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 (937) allow rem CVE-2014-53836.5SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspeci CVE-2014-53845.0The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of ser CVE-2014-53855.0com/salesmanager/central/profile/ProfileAction.java in Shopizer 1.1.5 and earlier does not restrict the number of authentication attempts, w CVE-2014-53865.0The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed CVE-2014-53876.5Multiple SQL injection vulnerabilities in EllisLab ExpressionEngine before 2.9.1 allow remote authenticated users to execute arbitrary SQL c CVE-2014-53884.6Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sen CVE-2014-53897.5SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to CVE-2014-53914.3Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.CVE-2014-53925.8XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of CVE-2014-53934.0Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.7.x before 1.7.4241