Innominate mGuard Improper Privilege Management
Summary
| CVE | CVE-2014-9193 |
|---|---|
| State | PUBLISHED |
| Assigner | icscert |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-12-20 00:59:03 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Innominate mGuard with firmware before 7.6.6 and 8.x before 8.1.4 allows remote authenticated admins to obtain root privileges by changing a PPP configuration setting. |
Risk And Classification
Primary CVSS: v2.0 9 from [email protected]
AV:N/AC:L/Au:S/C:C/I:C/A:C
Problem Types: CWE-269 | CWE-264 | CWE-269 CWE-269
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 2.0 | [email protected] | Primary | 9 | AV:N/AC:L/Au:S/C:C/I:C/A:C | |
| 2.0 | [email protected] | Secondary | 8.5 | AV:N/AC:M/Au:S/C:C/I:C/A:C | |
| 2.0 | CNA | CVSS | 8.5 | AV:N/AC:M/Au:S/C:C/I:C/A:C |
CVSS v2.0 Breakdown
AV:N/AC:L/Au:S/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Innominate | Mguard Firmware | 8.0.0 | All | All | All |
| Operating System | Innominate | Mguard Firmware | 8.0.1 | All | All | All |
| Operating System | Innominate | Mguard Firmware | 8.0.2 | All | All | All |
| Operating System | Innominate | Mguard Firmware | 8.0.3 | All | All | All |
| Operating System | Innominate | Mguard Firmware | 8.1.1 | All | All | All |
| Operating System | Innominate | Mguard Firmware | 8.1.2 | All | All | All |
| Operating System | Innominate | Mguard Firmware | 8.1.3 | All | All | All |
| Operating System | Innominate | Mguard Firmware | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Innominate | MGuard | affected 8.1.3 custom | Not specified |
| CNA | Innominate | MGuard | unaffected 7.6.6 | Not specified |
| CNA | Innominate | MGuard | unaffected 8.1.4 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Innominate mGuard Privilege Escalation Vulnerability | ICS-CERT | af854a3a-2127-422b-91ae-364da2661108 | ics-cert.us-cert.gov | Third Party Advisory, US Government Resource |
| PHOENIX CONTACT | PHOENIX CONTACT Cyber Security GmbH | af854a3a-2127-422b-91ae-364da2661108 | www.innominate.com | Vendor Advisory |
| www.cisa.gov/news-events/ics-advisories/icsa-14-352-02 | [email protected] | www.cisa.gov | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Innominate Security Technologies has identified a privilege escalation vulnerability affecting all mGuard devices. (en)
Additional Advisory Data
Solutions
CNA: Innominate has released firmware patches Version 7.6.6 and Version 8.1.4 that mitigates the vulnerability in the mGuard firmware Version 7 and Version 8, respectively. Innominate recommends that customers using firmware versions older than Version 7, which are no longer being maintained, should upgrade to mGuard firmware Version 7.6.6 or Version 8.1.4. Innominate also recommends that customers limit access to the administrative interfaces to a minimum via firewall rules. For additional information on the vulnerability, Innominate’s security advisory is available on its web site at: http://www.innominate.com/en/downloads/security-advisories Innominate’s firmware updates are available on its web site at: http://www.innominate.com/en/downloads/updates
Legacy QID Mappings
- 591069 Phoenix Contact Innominate mGuard devices Vulnerability (Security Advisory 2014/12/17-001)