CVE-2014-9222

🗓️ 24 Dec 2014 18:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 182 Views🌐 WEB

AllegroSoft RomPager 4.34 - "Misfortune Cookie" vulnerabilit

Reporter	Title	Published	Views	Family All 30
0day.today	RomPager 4.34 - Misfortune Cookie Router Authentication Bypass	27 Apr 201600:00	–	zdt
Tenable Nessus	Allegro RomPager 4.07 < 4.34 Multiple Vulnerabilities (Misfortune Cookie)	20 Feb 201500:00	–	nessus
Tenable Nessus	Allegro RomPager HTTP Cookie Management Remote Code Execution Vulnerability (Misfortune Cookie)	30 Dec 201400:00	–	nessus
Tenable Nessus	Allegro RomPager HTTP Cookie Management Remote Code Execution Vulnerability (Misfortune Cookie)	24 Dec 201400:00	–	nessus
Circl	CVE-2014-9222	29 May 201815:50	–	circl
Check Point Advisories	RomPager Authentication Security Bypass - Misfortune Cookie (CVE-2014-9222)	3 Dec 201400:00	–	checkpoint_advisories
Cvelist	CVE-2014-9222	24 Dec 201418:00	–	cvelist
canvas	Immunity Canvas: CVE_2014_9222	24 Dec 201418:59	–	canvas
Exploit DB	RomPager 4.34 (Multiple Router Vendors) - 'Misfortune Cookie' Authentication Bypass	27 Apr 201600:00	–	exploitdb
exploitpack	RomPager 4.34 (Multiple Router Vendors) - Misfortune Cookie Authentication Bypass	27 Apr 201600:00	–	exploitpack

NVD

Node

allegrosoft rompagerRange≤4.07

Source	Link
huawei	www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-407666.htm
mis	www.mis.fortunecook.ie/
allegrosoft	www.allegrosoft.com/allegro-software-urges-manufacturers-to-maintain-firmware-for-highest-level-of-embedded-device-security/news-press.html
seclists	www.seclists.org/fulldisclosure/2014/Dec/87
kb	www.kb.cert.org/vuls/id/561444
securityfocus	www.securityfocus.com/bid/105173

Parameter	Position	Path	Description	CWE
NewNTPServer1	request body	UD/act?1	TR-064 SetNTPServers can be abused to run commands such as configuring NTP servers, enabling shell commands to affect device firewall and administration access.	CWE-17
NewNTPServer2	request body	UD/act?1	TR-064 SetNTPServers can be abused to run commands such as configuring NTP servers, enabling shell commands to affect device firewall and administration access.	CWE-17
NewNTPServer3	request body	UD/act?1	TR-064 SetNTPServers can be abused to run commands such as configuring NTP servers, enabling shell commands to affect device firewall and administration access.	CWE-17
NewNTPServer4	request body	UD/act?1	TR-064 SetNTPServers can be abused to run commands such as configuring NTP servers, enabling shell commands to affect device firewall and administration access.	CWE-17
NewNTPServer5	request body	UD/act?1	TR-064 SetNTPServers can be abused to run commands such as configuring NTP servers, enabling shell commands to affect device firewall and administration access.	CWE-17
GetSecurityKeys	request body	UD/act?1	TR-064 WLANConfiguration GetSecurityKeys exposes the Wi-Fi pre-shared key, enabling password disclosure.	CWE-17
NewPreSharedKey	request body	UD/act?1	TR-064 WLANConfiguration GetSecurityKeys exposes the Wi-Fi pre-shared key, enabling password disclosure.	CWE-17

06 May 2026 22:30Current

7.7High risk

Vulners AI Score7.7

CVSS 210

EPSS0.86447

allegrosoft rompager "misfortune cookie"cve-2014-9222 memory corruption huawei home gateway remote attackers privilege escalation