CVE-2014-1409

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-08 · updated 2026-06-17
Weakness: CWE-91

Description

MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords

Affected products

Mobileiron Sentry: before 5.0 — fixed in 5.0
Mobileiron Virtual Smartphone Platform: before 5.9.1 — fixed in 5.9.1

How to fix

Upgrade to a fixed version: Mobileiron Sentry 5.0; Mobileiron Virtual Smartphone Platform 5.9.1. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2014/Apr/21
https://exchange.xforce.ibmcloud.com/vulnerabilities/92351
https://packetstormsecurity.com/files/cve/CVE-2014-1409
http://seclists.org/fulldisclosure/2014/Apr/21
https://exchange.xforce.ibmcloud.com/vulnerabilities/92351
https://packetstormsecurity.com/files/cve/CVE-2014-1409

Get alerted when CVE-2014-1409 or the next vulnerability affects your stack