CVE-2014-2378
CVE-2014-2378 is a medium-severity vulnerability in Sensysnetworks Trafficdot with a CVSS 2.0 base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-494.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.5)
- EPSS exploit prediction: 1% (55th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-494
- Affected product: Sensysnetworks Trafficdot
- Published:
- Last modified:
Description
Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.
Frequently asked questions
- What is CVE-2014-2378?
- Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.
- How severe is CVE-2014-2378?
- CVE-2014-2378 has a CVSS 2.0 base score of 6.5, rated medium severity.
- Is CVE-2014-2378 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-2378?
- CVE-2014-2378 primarily affects Sensysnetworks Trafficdot. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-2378?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-2378 published?
- CVE-2014-2378 was published on 2014-09-05 and last updated on 2026-06-17.
References
- http://www.sensysnetworks.com/distributors/
- http://www.sensysnetworks.com/resources-by-category/#sw
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-247-01a
- https://ics-cert.us-cert.gov/advisories/ICSA-14-247-01
Affected products (11)
- cpe:2.3:a:sensysnetworks:trafficdot:*:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:trafficdot:2.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:trafficdot:2.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:trafficdot:2.10.1:*:*:*:*:*:*:*
- cpe:2.3:h:sensysnetworks:vsn240-f:-:*:*:*:*:*:*:*
- cpe:2.3:h:sensysnetworks:vsn240-t:-:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:vds:*:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:vds:1.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:vds:1.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:vds:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:sensysnetworks:vds:2.6.4:*:*:*:*:*:*:*
More vulnerabilities in Sensysnetworks Trafficdot
- CVE-2014-2379 — Medium (CVSS 4.3): Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption,…
All CVEs affecting Sensysnetworks Trafficdot →
Other CWE-494 vulnerabilities
- CVE-2020-1595 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from…
- CVE-2020-1210 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source…
- CVE-2026-42248 — Critical (CVSS 9.8): Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike…
- CVE-2026-34841 — Critical (CVSS 9.8): Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack…
- CVE-2026-3000 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…
- CVE-2026-2999 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…