CVE-2014-8389

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.htmlExploit, Mitigation, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/29Exploit, Mailing List, Mitigation, Third Party Advisory
http://www.securityfocus.com/archive/1/535938/100/0/threaded
http://www.securityfocus.com/bid/75559Exploit, Mitigation, Third Party Advisory, VDB Entry
https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injectionExploit, Mitigation, Technical Description, Third Party Advisory
http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.htmlExploit, Mitigation, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/29Exploit, Mailing List, Mitigation, Third Party Advisory
http://www.securityfocus.com/archive/1/535938/100/0/threaded
http://www.securityfocus.com/bid/75559Exploit, Mitigation, Third Party Advisory, VDB Entry
https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injectionExploit, Mitigation, Technical Description, Third Party Advisory

Timeline

Published: Dec 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-83904.4Multiple buffer overflows in Schneider Electric VAMPSET before 2.2.168 allow local users to gain privileges via malformed disturbance-record CVE-2014-83914.0The Web interface in Sendio before 7.2.4 does not properly handle sessions, which allows remote authenticated users to obtain sensitive info CVE-2014-83937.8DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion.CVE-2014-83944.6Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attac CVE-2014-83954.6Untrusted search path vulnerability in Corel Painter 2015 allows local users to execute arbitrary code and conduct DLL hijacking attacks via CVE-2014-83964.6Untrusted search path vulnerability in Corel PDF Fusion allows local users to execute arbitrary code and conduct DLL hijacking attacks via a CVE-2014-83974.6Untrusted search path vulnerability in Corel VideoStudio PRO X7 or FastFlick allows local users to execute arbitrary code and conduct DLL hi CVE-2014-83984.6Multiple untrusted search path vulnerabilities in Corel FastFlick allow local users to execute arbitrary code and conduct DLL hijacking atta CVE-2014-83992.1The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via CVE-2014-84125.0The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before CVE-2014-84137.5The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in CVE-2014-84145.0ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allow