{"api_version":"1","generated_at":"2026-07-23T06:41:58+00:00","cve":"CVE-2014-1612","urls":{"html":"https://cve.report/CVE-2014-1612","api":"https://cve.report/api/cve/CVE-2014-1612.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-1612","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-1612"},"summary":{"title":"CVE-2014-1612","description":"Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-01-30 18:55:03","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90656","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90656","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/252294","name":"http://www.kb.cert.org/vuls/id/252294","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"Vulnerability Note VU#252294 - Mediatrix 4402 digital gateway web interface contains a cross-site scripting (XSS) vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/530871/100/0/threaded","name":"http://www.securityfocus.com/archive/1/530871/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html","name":"http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Mediatrix 4402 Cross Site Scripting ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/65108","name":"http://www.securityfocus.com/bid/65108","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Mediatrix 4402 Web Management Interface 'login' Page Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/56638","name":"http://secunia.com/advisories/56638","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA56638 - Mediatrix 4402 VoIP Gateway "username" Cross-Site Scripting Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/102415","name":"http://osvdb.org/102415","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1612","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1612","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"1612","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"media5","cpe5":"mediatrix_voip_gateway","cpe6":"4402","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"1612","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"media5","cpe5":"mediatrix_voip_gateway_4402_firmware","cpe6":"dgw_1.1.13.186","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2014","cve_id":"1612","cve":"CVE-2014-1612","epss":"0.005650000","percentile":"0.685060000","score_date":"2026-05-04","updated_at":"2026-05-05 00:07:32"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:50:09.311Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/530871/100/0/threaded"},{"name":"mediatrixwebmanagement-cve20141612-xss(90656)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90656"},{"name":"VU#252294","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/252294"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html"},{"name":"102415","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/102415"},{"name":"65108","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/65108"},{"name":"56638","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/56638"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-01-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/530871/100/0/threaded"},{"name":"mediatrixwebmanagement-cve20141612-xss(90656)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90656"},{"name":"VU#252294","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/252294"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html"},{"name":"102415","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/102415"},{"name":"65108","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/65108"},{"name":"56638","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/56638"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-1612","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20140123 Reflected cross-site scripting (XSS) vulnerability in Mediatrix Web Management Interface login page","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/530871/100/0/threaded"},{"name":"mediatrixwebmanagement-cve20141612-xss(90656)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90656"},{"name":"VU#252294","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/252294"},{"name":"http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/124931/Mediatrix-4402-Cross-Site-Scripting.html"},{"name":"102415","refsource":"OSVDB","url":"http://osvdb.org/102415"},{"name":"65108","refsource":"BID","url":"http://www.securityfocus.com/bid/65108"},{"name":"56638","refsource":"SECUNIA","url":"http://secunia.com/advisories/56638"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-1612","datePublished":"2014-01-30T18:00:00.000Z","dateReserved":"2014-01-20T00:00:00.000Z","dateUpdated":"2024-08-06T09:50:09.311Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-01-30 18:55:03","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:media5:mediatrix_voip_gateway_4402_firmware:dgw_1.1.13.186:*:*:*:*:*:*:*","matchCriteriaId":"841E2BDD-A155-442D-B437-4CB51CA1FCA0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:media5:mediatrix_voip_gateway:4402:*:*:*:*:*:*:*","matchCriteriaId":"64621837-5FF1-4003-9B24-472387B86155"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"1612","Ordinal":"1","Title":"CVE-2014-1612","CVE":"CVE-2014-1612","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"1612","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in login.esp in the Web Management Interface in Media5 Mediatrix 4402 VoIP Gateway with firmware Dgw 1.1.13.186 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.","Type":"Description","Title":"CVE-2014-1612"},{"CveYear":"2014","CveId":"1612","Ordinal":"2","NoteData":"2014-01-30","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"1612","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}