CVE-2014-9222

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, aka the "Misfortune Cookie" vulnerability.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-17

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://mis.fortunecook.ie/Technical Description, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/87Mailing List, Third Party Advisory
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-407666.htmVendor Advisory
http://www.kb.cert.org/vuls/id/561444Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/105173
https://www.allegrosoft.com/allegro-software-urges-manufacturers-to-maintain-firmware-for-highest-level-of-embedded-device-security/news-press.htmlThird Party Advisory
http://mis.fortunecook.ie/Technical Description, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/87Mailing List, Third Party Advisory
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-407666.htmVendor Advisory
http://www.kb.cert.org/vuls/id/561444Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/105173
https://www.allegrosoft.com/allegro-software-urges-manufacturers-to-maintain-firmware-for-highest-level-of-embedded-device-security/news-press.htmlThird Party Advisory

Timeline

Published: Dec 24, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-922310.0Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote atta CVE-2014-92243.5Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critic CVE-2014-92254.0The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Securi CVE-2014-92267.2The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SD CVE-2014-92274.4Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local user CVE-2014-92284.9sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (b CVE-2014-92296.5Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 CVE-2014-92304.3Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 1 CVE-2014-92345.0Directory traversal vulnerability in cgi-bin/sddownload.cgi in D-link IP camera DCS-2103 with firmware 1.0.0 allows remote attackers to read CVE-2014-92356.5Multiple SQL injection vulnerabilities in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allow remote authenticated users to execute arb CVE-2014-92364.3Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier allows remote attacker CVE-2014-92377.5SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in