CVE-2014-8243
Last modified
CVE-2014-8243 is a vulnerability of currently unknown severity. Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain the administrator's MD5 password hash via a direct request for the /.htpasswd URI.. EPSS estimates a 1.20% chance of exploitation in the next 30 days.
Description
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain the administrator's MD5 password hash via a direct request for the /.htpasswd URI.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linksys | Ea4500 Firmware | <= 2.0.14212.1 | — |
| Linksys | Ea4500 | All versions | — |
| Linksys | Ea6500 Firmware | <= 1.1.40 | 153731 |
| Linksys | Ea6500 | All versions | — |
| Linksys | Ea6400 Firmware | <= 1.1.40 | 153731 |
| Linksys | Ea6400 | All versions | — |
| Linksys | E4200v2 Firmware | <= 2.0.14212.1 | — |
| Linksys | E4200v2 | All versions | — |
| Linksys | Ea6300 Firmware | <= 1.1.40 | 153731 |
| Linksys | Ea6300 | All versions | — |
| Linksys | Ea6900 Firmware | <= 1.1.42 | 158863 |
| Linksys | Ea6900 | All versions | — |
| Linksys | Ea2700 Firmware | <= 2.0.14294 | — |
| Linksys | Ea2700 | All versions | — |
| Linksys | Ea3500 Firmware | <= 2.0.14294 | — |
| Linksys | Ea3500 | All versions | — |
| Linksys | Ea6200 Firmware | <= 1.1.41 | 153743 |
| Linksys | Ea6200 | All versions | — |
| Linksys | Ea6700 Firmware | <= 1.1.40 | 153731 |
| Linksys | Ea6700 | All versions | — |
References
- http://www.kb.cert.org/vuls/id/447516Exploit, Patch, Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/447516Exploit, Patch, Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-8243?
How severe is CVE-2014-8243?
How do I fix CVE-2014-8243?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2014
- CVE-2014-8237Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2014-8238Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2014-8239Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2014-8240Integer overflow in TigerVNC allows remote VNC servers to ca…
- CVE-2014-8241XRegion in TigerVNC allows remote VNC servers to cause a den…
- CVE-2014-8242librsync before 1.0.0 uses a truncated MD4 checksum to match…
- CVE-2014-8244Linksys SMART WiFi firmware on EA2700 and EA3500 devices; be…
- CVE-2014-8246Cross-site request forgery (CSRF) vulnerability in CA Releas…
- CVE-2014-8247Cross-site scripting (XSS) vulnerability in CA Release Autom…
- CVE-2014-8248SQL injection vulnerability in CA Release Automation (former…
- CVE-2014-8266Multiple cross-site scripting (XSS) vulnerabilities in the n…
- CVE-2014-8267Cross-site scripting (XSS) vulnerability in QPR Portal 2014.…
Are you affected by CVE-2014-8243?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST