CVE-2014-5419
HighSummary
GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations. This makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.
Risk Assessment
The use of the same RSA private key across different installations poses a risk that attackers may intercept sensitive data transmitted over the network, potentially leading to serious security breaches.
Recommendation
It is recommended to update the firmware of the switches to the latest version to ensure the uniqueness of RSA private keys for each installation and enhance the security of transmitted data.
Related vulnerabilities
- CVE-2026-125757Critical
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
- CVE-2026-121683Critical
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
- CVE-2026-121653Critical
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- CVE-2026-108186Critical
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- CVE-2026-124917Critical
Sandbox escape vulnerability due to use-after-free in the Widget: Gtk component of Firefox. It may allow bypassing process isolation. The vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124903Critical
A sandbox escape due to a use-after-free exists in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124900Critical
A use-after-free in the DOM: Service Workers component of Firefox allows a sandbox escape. The vulnerability was fixed in Firefox 160.
- CVE-2026-124864Critical
Use-after-free vulnerability in the DOM: Service Workers component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124861Critical
Use-after-free vulnerability in the Audio/Video: cubeb component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124859Critical
Sandbox escape in the Storage: Cache API component of Firefox caused by incorrect boundary conditions. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Original NVD description (English source)
GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key across different customers' installations, which makes it easier for remote attackers to obtain the cleartext content of network traffic by reading this key from a firmware image and then sniffing the network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS