CVE-2014-4623

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-10-25 · updated 2026-06-17
Weakness: CWE-310

Description

EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.

Affected products

EMC Avamar: 6.0.1, 6.0.2, 6.0.3, 6.1, 6.1.101-87, 7.0 (+1)

References

http://archives.neohapsis.com/archives/bugtraq/2014-10/0146.html
http://packetstormsecurity.com/files/128842/EMC-Avamar-Weak-Password-Storage.html
http://www.securityfocus.com/bid/70732
http://www.securitytracker.com/id/1031117
https://exchange.xforce.ibmcloud.com/vulnerabilities/97757
http://archives.neohapsis.com/archives/bugtraq/2014-10/0146.html
http://packetstormsecurity.com/files/128842/EMC-Avamar-Weak-Password-Storage.html
http://www.securityfocus.com/bid/70732
http://www.securitytracker.com/id/1031117
https://exchange.xforce.ibmcloud.com/vulnerabilities/97757

Get alerted when CVE-2014-4623 or the next vulnerability affects your stack