CVE-2014-2962 describes an absolute path traversal vulnerability in the webproc cgi module of the Belkin N150 F9K1009 v1 router with firmware before 1.00.08. This flaw allows unauthenticated remote attackers to read arbitrary files on the device by supplying a full pathname in the 'getpage' parameter. With a CVSS score of 7.8 (High), this vulnerability is easily exploitable over the network with low attack complexity, leading to complete confidentiality compromise. While not listed in CISA's KEV catalog, exploit code is publicly available via ExploitDB and Nuclei templates, and it has garnered significant community discussion and media coverage, indicating a high potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.00.07CPE matchmatch criteria | cpe:2.3:o:belkin:n150_f9k1009_firmware:*:*:*:*:*:*:*:* | ||
1.00.01CPE matchmatch criteria | cpe:2.3:o:belkin:n150_f9k1009_firmware:1.00.01:*:*:*:*:*:*:* | ||
v1CPE matchmatch criteria | cpe:2.3:h:belkin:n150_f9k1009:v1:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.