CVE-2018-14494

moderate-risk
Published 2019-07-10

Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, although this CVE was first populated in July 2019, it is a historical vulnerability that does not apply to any current or recent Vivotek hardware or firmware

Do I need to act?

!
11.3% chance of exploitation in next 30 days
EPSS score — higher than 89% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Vivotek

References (4)

Third Party Advisory https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-select...
Third Party Advisory https://www.vdalabs.com/2018/08/06/professional-iot-hacking-series-hunting-remot...
Third Party Advisory https://www.vdalabs.com/2018/07/23/professional-iot-hacking-series-target-select...
Third Party Advisory https://www.vdalabs.com/2018/08/06/professional-iot-hacking-series-hunting-remot...
48
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 11/34 · Low
Exposure 5/34 · Minimal