Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.0

VDG Security SENSE 2.3.13 discloses user passwords on login

CVE-2014-9577 · published 11 years ago
Summary

When a user logs in, VDG Security SENSE version 2.3.13 sends the entire user database over TCP port 51410. An attacker who can authenticate to that port can read usernames and password hashes. Apply the vendor’s update or disable the login feature and reset all passwords.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
vdgsecurity vdg_sense 2.3.13
cpe:2.3:a:vdgsecurity:vdg_sense:2.3.13:*:*:*:*:*:*:*
Original advisory text
VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 5141...
VDG Security SENSE (formerly DIVA) 2.3.13 sends the user database when a user logs in, which allows remote authenticated users to obtain usernames and password hashes by logging in to TCP port 51410 and reading the response.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published8 Jan 2015
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-9577 · NVD
Track software like this
Free during beta