CVE-2014-5419
Estado: ModificadaMedia (5)—
GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
- Puntuación base: 5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.42%
- Percentil entre todas las CVEs puntuadas: 84
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (14)
GE — Multilink Ml1200GE — Multilink Ml1200 FirmwareGE — Multilink Ml1600GE — Multilink Ml1600 FirmwareGE — Multilink Ml2400GE — Multilink Ml2400 FirmwareGE — Multilink Ml3000GE — Multilink Ml3000 FirmwareGE — Multilink Ml3100GE — Multilink Ml3100 FirmwareGE — Multilink Ml800GE — Multilink Ml800 FirmwareGE — Multilink Ml810GE — Multilink Ml810 Firmware
CWE
- CWE-321
- CWE-310
Referencias
- http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json
- https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a
- http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf
- https://ics-cert.us-cert.gov/advisories/ICSA-15-013-04
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-5419",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Secondary",
"source": "ics-cert@hq.dhs.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "ics-cert@hq.dhs.gov",
"affectedData": [
{
"vendor": "GE",
"product": "Multilink ML800/1200/1600/2400",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "4.2.1"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "GE",
"product": "ML810/3000/3100 series switch",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "5.2.0"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2015-01-17T02:59:02.600",
"references": [
{
"url": "http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf",
"tags": [
"Vendor Advisory"
],
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-013-04a.json",
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-013-04a",
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "http://www.gedigitalenergy.com/products/support/multilink/MLSB1214.pdf",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-013-04",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "ics-cert@hq.dhs.gov",
"description": [
{
"lang": "en",
"value": "CWE-321"
}
]
},
{
"type": "Secondary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-310"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network."
},
{
"lang": "es",
"value": "Los switches GE Multilink ML800, ML1200, ML1600, y ML2400 con firmware 4.2.1 y anteriores y los switches Multilink ML810, ML3000, y ML3100 con firmware 5.2.0 y anteriores utilizan la misma clave RSA privada en instalaciones diferentes de cliente, lo que facilita a atacantes remotos obtener el contenido en texto plano de trafico de la red mediante la lectura de esta clave de una imagen de firmware y posteriormente la captura de trafico de la red."
}
],
"lastModified": "2026-06-17T00:11:31.640",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_ml3100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "339C1069-C126-4840-92DC-0DBE17FD764C",
"versionEndIncluding": "5.2.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml3100:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A16124C-6614-4EF1-912B-D16145997AF6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_ml3000_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F8CCA289-8E58-41E9-9AD3-860A6B373EE3",
"versionEndIncluding": "5.2.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml3000:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "359B13A0-4CCC-4E7A-A5C0-BF568EE01282"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_ml810_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D14EC388-6D6C-49BA-9436-9708236B5BD0",
"versionEndIncluding": "5.2.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml810:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81DC26E5-D3D7-41C6-B654-B06FA0461451"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_ml1600_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2F6933C-8017-4BE1-82D3-81785EA99BB6",
"versionEndIncluding": "4.2.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml1600:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "620703E4-1D78-44CB-B353-517A8AB2A815"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_ml800_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12A4D84B-AA33-4FC4-BBDF-AD0A0324D80F",
"versionEndIncluding": "4.2.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml800:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9A00E85C-1B21-43F7-8323-F759216BFB90"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_ml2400_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F63F2FB-8E3A-4691-A74E-32DA333030DC",
"versionEndIncluding": "4.2.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml2400:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "426A283A-540C-43F2-8397-52668BADDEB8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:ge:multilink_ml1200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "220E7CFA-4C66-498A-B0FA-1F4362D50732",
"versionEndIncluding": "4.2.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:ge:multilink_ml1200:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1179F179-510A-4A97-8365-B81C0E0FC605"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov"
}