CVE-2014-9196

Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.

CVSS v2.0 7.6 HIGH

7.6^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 4.9 / Impact : 10.0

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/75936
https://www.cisa.gov/news-events/ics-advisories/icsa-15-006-01
https://www.eaton.com/cybersecurity
http://www.securityfocus.com/bid/75936
https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eaton:proview:4.0:::::::*
	cpe:2.3:a:eaton:proview:5.0:::::::*
	cpe:2.3:a:eaton:proview:5.0.1:::::::*
	cpe:2.3:a:eaton:proview:5.0.2:::::::*
	cpe:2.3:a:eaton:proview:5.0.3:::::::*
	cpe:2.3:a:eaton:proview:5.0.4:::::::*
	cpe:2.3:a:eaton:proview:5.0.5:::::::*
	cpe:2.3:a:eaton:proview:5.0.6:::::::*
	cpe:2.3:a:eaton:proview:5.0.7:::::::*
	cpe:2.3:a:eaton:proview:5.0.8:::::::*
	cpe:2.3:a:eaton:proview:5.0.9:::::::*
	cpe:2.3:a:eaton:proview:5.0.10:::::::*

History

05 Sep 2025, 21:15

Type	Values Removed	Values Added
References		() https://www.cisa.gov/news-events/ics-advisories/icsa-15-006-01 - () https://www.eaton.com/cybersecurity -
CVSS	v2 : ~~9.3~~ v3 : ~~unknown~~	v2 : 7.6 v3 : unknown
CWE		CWE-342

Information

Published : 2015-07-20 01:59

Updated : 2025-09-05 21:15

NVD link : CVE-2014-9196

Mitre link : CVE-2014-9196

CVE.ORG link : CVE-2014-9196

JSON object : View

Products Affected

eaton

proview

CWE

CWE-342

Predictable Exact Value from Previous Values

CWE-254

7PK - Security Features

{"id": "CVE-2014-9196", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-07-20T01:59:01.113", "references": [{"url": "http://www.securityfocus.com/bid/75936", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-15-006-01", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.eaton.com/cybersecurity", "source": "ics-cert@hq.dhs.gov"}, {"url": "http://www.securityfocus.com/bid/75936", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-342"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-254"}]}], "descriptions": [{"lang": "en", "value": "Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value."}, {"lang": "es", "value": "'ulnerabilidad en Eaton Cooper Power Systems ProView en las versiones 4.0 y 5.0 anterior a la 5.0 11 Form 6 controles e Idea e IdeaPLUS relay genera un n\u00famero TCP inicial de secuencia (ISN) de valores lineales, lo que hace que sea m\u00e1s f\u00e1cil para los atacantes remotos falsificar las sesiones TCP al predecir un valor ISN."}], "lastModified": "2025-09-05T21:15:33.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eaton:proview:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09E9D87B-D0F2-48DD-97F1-9CB5D7B319E8"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD294C06-DCE8-45B1-A59E-E45CB50CA089"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91712733-5783-4B9A-8BD8-62A32229BC03"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDCAC23C-22B9-4862-A967-453812EEAA3F"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91DEAC57-6765-4470-963E-E9EC364657AF"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "955879A7-9F8F-47F2-B8F0-7D62AB69261D"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADF48CE1-EC38-4F11-82D1-514C993AF1FA"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9705072-55EE-46E6-B124-8C7A20D6DC03"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04909702-7055-4822-BAB8-139EBF4E409C"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7484B7D1-D109-4E5E-B26F-4FEB88E68EB1"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E64750AD-BAA4-4837-BA51-87019A585C91"}, {"criteria": "cpe:2.3:a:eaton:proview:5.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BFA9727-CBCA-45BC-B4BA-0B5730C05450"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}