Meinberg Radio Clocks LANTIME M-Series
Summary
| CVE | CVE-2014-5417 |
|---|---|
| State | PUBLISHED |
| Assigner | icscert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-11-05 11:55:06 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Cross-site scripting (XSS) vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
Risk And Classification
Primary CVSS: v2.0 4.3 from [email protected]
AV:N/AC:M/Au:N/C:N/I:P/A:N
Problem Types: CWE-79 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 2.0 | [email protected] | Primary | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | |
| 2.0 | [email protected] | Secondary | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | |
| 2.0 | CNA | CVSS | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Meinberg | Lantime M100 | All | All | All | All |
| Hardware | Meinberg | Lantime M200 | All | All | All | All |
| Hardware | Meinberg | Lantime M300 | All | All | All | All |
| Hardware | Meinberg | Lantime M3000 | All | All | All | All |
| Hardware | Meinberg | Lantime M400 | All | All | All | All |
| Hardware | Meinberg | Lantime M600 | All | All | All | All |
| Hardware | Meinberg | Lantime M900 | All | All | All | All |
| Operating System | Meinberg | Ntp Server Firmware | - | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Meinberg Radio Clocks | LANTIME M-Series | affected 6.15.019 custom | Not specified |
| CNA | Meinberg Radio Clocks | LANTIME M-Series | unaffected 6.15.020 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| news.meinberg.de/259 | [email protected] | news.meinberg.de | |
| github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-27... | [email protected] | github.com | |
| Meinberg Radio Clocks LANTIME M-Series XSS | ICS-CERT | af854a3a-2127-422b-91ae-364da2661108 | ics-cert.us-cert.gov | Third Party Advisory, US Government Resource |
| www.cisa.gov/news-events/ics-advisories/icsa-14-275-01 | [email protected] | www.cisa.gov | |
| Meinberg Security Advisory: [MBGSA-1404] LANTIME Web Interface Cross Site Scripting Vulnerability - Meinberg News | af854a3a-2127-422b-91ae-364da2661108 | www.meinbergglobal.com | Vendor Advisory |
| LANTIME M-Series Servers CVE-2014-5417 Unspecified Cross Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Martem Telecontrol Systems security researcher Aivar Liimets (en)
Additional Advisory Data
Solutions
CNA: Meinberg’s firmware update, Version 6.15.020, resolves this vulnerability. Please contact Meinberg customer service for information on how to download and install the firmware update, or obtain the update at the following online location: http://news.meinberg.de/259 Meinberg – Radio Clocks Lange Wand 9 D-31812 Bad Pyrmont Phone: ++49(0)5281-9309 0 Fax: ++49(0)5281-9309 30 http:www.meinberg.de http://www.meinberg.de/ Email: [email protected]
There are currently no legacy QID mappings associated with this CVE.