PT-2022-7761 · Cardo Systems · Cardo Systems Scala Rider Q3+1

Max Moser · Published 2022-05-24 · Updated 2022-06-08 · CVE-2014-125001

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cardo Systems Scala Rider Q3 (affected versions not specified)

Description A critical issue has been discovered, allowing unauthenticated remote code execution with root permissions. This is related to the file /cardo/api of the Cardo-Updater.

Recommendations For Cardo Systems Scala Rider Q3, consider firewalling or disabling the service as a mitigation measure until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2014-125001

Affected Products

Cardo Systems Scala Rider Q3

Cardo-Updater

References · 4

• 🔥 http://remote-exploit.org/archives/2014/06/03/ride_with_the_devil · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-125001 · Security Note
• https://t.me/cibsecurity/43286 · Telegram Post
• https://vuldb.com/?id.13428 · Note