CVE-2014-125001: Cardo Systems Scala Rider Q3 Cardo-Updater api privileges management

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-24 · updated 2026-06-17
Weakness: CWE-269

Description

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended.

Affected products

Cardo Systems Scala Rider Q3: all versions

References

http://www.remote-exploit.org/archives/2014/06/03/ride_with_the_devil/
https://vuldb.com/?id.13428
http://www.remote-exploit.org/archives/2014/06/03/ride_with_the_devil/
https://vuldb.com/?id.13428

Get alerted when CVE-2014-125001 or the next vulnerability affects your stack