CVE-2014-7249
Critical
Description
Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 9924SP, CentreCOM 9924T/4SP, Rapier 48i, and SwitchBlade4000 with firmware before 2.9.1-21 allows remote attackers to execute arbitrary code via a crafted HTTP POST request.
SeverityCritical
CVSS10.0
Exploit probability—
ProductAlliedtelesis Centrecom Ar415s Firmware
PublishedDec 19, 2014
First seenDec 19, 2014
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alliedtelesis centrecom_ar415s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_ar415s | No range specified | — |
| alliedtelesis at-8624t\/2m_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-8624t\/2m | No range specified | — |
| alliedtelesis ar442s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis ar442s | No range specified | — |
| alliedtelesis at-9924t_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-9924t | No range specified | — |
| alliedtelesis at-8848_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-8848 | No range specified | — |
| alliedtelesis rapier_48i_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis rapier_48i | No range specified | — |
| alliedtelesis centrecom_ar450s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_ar450s | No range specified | — |
| alliedtelesis ar745_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis ar745 | No range specified | — |
| alliedtelesis ar441s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis ar441s | No range specified | — |
| alliedtelesis centrecom_9924sp_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_9924sp | No range specified | — |
| alliedtelesis switchblade4000_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis switchblade4000 | No range specified | — |
| alliedtelesis at-8624poe_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-8624poe | No range specified | — |
| alliedtelesis centrecom_9924t\/4sp_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_9924t\/4sp | No range specified | — |
| alliedtelesis at-9816gb_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-9816gb | No range specified | — |
| alliedtelesis at-9924ts_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-9924ts | No range specified | — |
| alliedtelesis ar750s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis ar750s | No range specified | — |
| alliedtelesis centrecom_ar570s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_ar570s | No range specified | — |
| alliedtelesis centrecom_8948xl_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_8948xl | No range specified | — |
| alliedtelesis at-8648t\/2sp_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-8648t\/2sp | No range specified | — |
| alliedtelesis centrecom_8700sl_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_ar8700sl | No range specified | — |
| alliedtelesis ar750s-dp_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis ar750s-dp | No range specified | — |
| alliedtelesis centrecom_ar550s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis centrecom_ar550s | No range specified | — |
| alliedtelesis at-8748xl_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis at-8748xl | No range specified | — |
| alliedtelesis ar440s_firmware | v ≤ 2.9.1-20 | — |
| alliedtelesis ar440s | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.