CVE-2014-2388

Estado: ModificadaMedia (6.1)—

The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode.

CVSS

Versión: 2.0
Vector: AV:A/AC:L/Au:N/C:C/I:N/A:N
Puntuación base: 6.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.21%
Percentil entre todas las CVEs puntuadas: 68
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Blackberry — Blackberry OS Blackberry — Q10 Blackberry — Q5 Blackberry — Z10 Blackberry — Z30

CWE

CWE-264

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2014-2388",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.1,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:C/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-08-18T11:15:25.667",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/127850",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/60156",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.blackberry.com/btsc/KB36174",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.modzero.ch/advisories/MZ-13-04-Blackberry_Z10-File-Exchange-Authentication-By-Pass.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533118/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/69217",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95262",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95263",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/127850",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/127850/BlackBerry-Z10-Authentication-Bypass.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60156",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.blackberry.com/btsc/KB36174",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.modzero.ch/advisories/MZ-13-04-Blackberry_Z10-File-Exchange-Authentication-By-Pass.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533118/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/69217",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95262",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95263",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which allows context-dependent attackers to read arbitrary files via (1) a session over a Wi-Fi network or (2) a session over a USB connection in Development Mode."
    },
    {
      "lang": "es",
      "value": "El servicio de almacenamiento y acceso en BlackBerry OS 10.x anterior a 10.2.1.1925 en los dispositivos Q5, Q10, Z10, y Z30 no aplica el requisito de contraseñas para el acceso al sistema de ficheros SMB, lo que permite a atacantes dependientes de contexto leer ficheros arbitrarios a través de (1) una sesión por una red Wi-Fi o (2) una sesión por una conexión USB en modo de desarrollo."
    }
  ],
  "lastModified": "2026-06-17T00:06:31.583",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:blackberry:blackberry_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04DA835E-8AC6-4D91-A7D4-CE989DB4DECE",
              "versionEndIncluding": "10.1.0.2354"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:blackberry:q10:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71D783CC-F87A-4D5E-AC9F-ABBE54FEEAF5"
            },
            {
              "criteria": "cpe:2.3:h:blackberry:q5:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DC93FBB-833A-4AEC-AFBB-DE267968CFE6"
            },
            {
              "criteria": "cpe:2.3:h:blackberry:z10:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFF10379-D135-47B8-90FF-E501AC736F45"
            },
            {
              "criteria": "cpe:2.3:h:blackberry:z30:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B771638-C251-41A7-98ED-32E773F11AA6"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}