CVE-2014-9754

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-20 · updated 2026-06-17
Weakness: CWE-20

Description

The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.

Affected products

Viprinet Multichannel Vpn Router 300 Firmware: 2013070830, 2013080900

References

http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300-Identity-Verification-Fail.html
http://seclists.org/fulldisclosure/2016/Feb/8
http://www.securityfocus.com/archive/1/537441/100/0/threaded
http://packetstormsecurity.com/files/135614/Viprinet-Multichannel-VPN-Router-300-Identity-Verification-Fail.html
http://seclists.org/fulldisclosure/2016/Feb/8
http://www.securityfocus.com/archive/1/537441/100/0/threaded

Get alerted when CVE-2014-9754 or the next vulnerability affects your stack