« Volver al listado

CVE-2014-5334

Estado: ModificadaCrítica (9.8)—

FreeNAS en versiones anteriores a la 9.3-M3 tiene una contraseña de administrador en blanco, lo que permite que los atacantes remotos obtengan privilegios root aprovechándose de un inicio de sesión en la interfaz gráfica de usuario web.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Freenas — Freenas

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-5334",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-01-08T19:29:00.580",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/08/19/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/69249",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.freenas.org/issues/5844",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/08/19/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/69249",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.freenas.org/issues/5844",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-254"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login."
    },
    {
      "lang": "es",
      "value": "FreeNAS en versiones anteriores a la 9.3-M3 tiene una contraseña de administrador en blanco, lo que permite que los atacantes remotos obtengan privilegios root aprovechándose de un inicio de sesión en la interfaz gráfica de usuario web."
    }
  ],
  "lastModified": "2026-06-17T00:11:23.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freenas:freenas:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FAD6979-C211-4D10-A267-90BEB630BFB8",
              "versionEndIncluding": "9.2.1.7"
            },
            {
              "criteria": "cpe:2.3:a:freenas:freenas:9.3:m1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "651AFADB-CAD1-4878-ADE5-706773A9F6F4"
            },
            {
              "criteria": "cpe:2.3:a:freenas:freenas:9.3:m2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE2474A1-E374-4B42-8EFB-AEFC05F0F3E6"
            },
            {
              "criteria": "cpe:2.3:a:freenas:freenas:9.3:m3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A350462-CA34-483D-8380-EB20B58E3C4E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}