CVE-2014-3402

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-10-10 · updated 2026-06-17
Weakness: CWE-287

Description

The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion Detection System (IDS) does not properly manage user tokens, which allows remote attackers to cause a denial of service (temporary MainApp hang) via a crafted connection request to the management interface, aka Bug ID CSCuq39550.

Affected products

Cisco Intrusion Prevention System: through 7.0\(8\)e4; 7.0, 7.0(1)e3, 7.0(2)e3, 7.0(2)e4, 7.0(3)e4, 7.0(4)e4 (+3)

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3402
http://tools.cisco.com/security/center/viewAlert.x?alertId=36014
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3402
http://tools.cisco.com/security/center/viewAlert.x?alertId=36014

Get alerted when CVE-2014-3402 or the next vulnerability affects your stack