Sensys Networks Traffic Sensor Download of Code Without Integrity Check
Summary
| CVE | CVE-2014-2378 |
|---|---|
| State | PUBLISHED |
| Assigner | icscert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-09-05 17:55:06 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update. |
Risk And Classification
Primary CVSS: v2.0 7.6 from [email protected]
AV:A/AC:M/Au:N/C:C/I:C/A:P
Problem Types: CWE-494 | CWE-94 | CWE-494 CWE-494
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 2.0 | [email protected] | Primary | 7.6 | AV:A/AC:M/Au:N/C:C/I:C/A:P | |
| 2.0 | [email protected] | Secondary | 6.5 | AV:A/AC:H/Au:N/C:C/I:C/A:P | |
| 2.0 | CNA | CVSS | 6.5 | AV:A/AC:H/Au:N/C:C/I:C/A:P |
CVSS v2.0 Breakdown
AV:A/AC:M/Au:N/C:C/I:C/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sensysnetworks | Trafficdot | 2.10.0 | All | All | All |
| Application | Sensysnetworks | Trafficdot | 2.10.1 | All | All | All |
| Application | Sensysnetworks | Trafficdot | 2.8.3 | All | All | All |
| Application | Sensysnetworks | Trafficdot | All | All | All | All |
| Application | Sensysnetworks | Vds | 1.8.5 | All | All | All |
| Application | Sensysnetworks | Vds | 1.8.7 | All | All | All |
| Application | Sensysnetworks | Vds | 2.6.3 | All | All | All |
| Application | Sensysnetworks | Vds | 2.6.4 | All | All | All |
| Application | Sensysnetworks | Vds | All | All | All | All |
| Hardware | Sensysnetworks | Vsn240-f | - | All | All | All |
| Hardware | Sensysnetworks | Vsn240-t | - | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Sensys Networks | VSN240-F | affected VDS 2.10.1 custom | Not specified |
| CNA | Sensys Networks | VSN240-F | affected VDS 1.8.8 custom | Not specified |
| CNA | Sensys Networks | VSN240-F | affected TrafficDOT 2.10.3 custom | Not specified |
| CNA | Sensys Networks | VSN240-T | affected VDS 2.10.1 custom | Not specified |
| CNA | Sensys Networks | VSN240-T | affected VDS 1.8.8 custom | Not specified |
| CNA | Sensys Networks | VSN240-T | affected TrafficDOT 2.10.3 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.sensysnetworks.com/distributors | [email protected] | www.sensysnetworks.com | |
| Sensys Networks Traffic Sensor Vulnerabilities (Update A) | ICS-CERT | af854a3a-2127-422b-91ae-364da2661108 | ics-cert.us-cert.gov | US Government Resource |
| www.cisa.gov/news-events/ics-advisories/icsa-14-247-01a | [email protected] | www.cisa.gov | |
| www.sensysnetworks.com/resources-by-category | [email protected] | www.sensysnetworks.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Cesar Cerrudo of IOActive (en)
Additional Advisory Data
Solutions
CNA: Sensys Networks has produced updated product versions VDS 2.10.1 and TrafficDOT 2.10.3 to remediate vulnerabilities identified in their VSN240-F and VSN240-T traffic sensors. Sensys Networks has released software update VDS 1.8.8, for an older model access point, to remediate traffic sensor vulnerabilities. The updated human-machine interface version, TrafficDOT 2.10.3, enables encrypted software downloads for sensors and sensor data authentication for access points and access point controller cards using updated versions VDS 2.10.1 or VDS 1.8.8. Additional information about Sensys Networks’ software releases can be found at the following location: http://www.sensysnetworks.com/resources-by-category/#sw Updated product versions are available through Sensys Networks’ local distributors. Contact information for their local distributors can be found at the following location: http://www.sensysnetworks.com/distributors/