Read the docs
TI-2014-01871 Aliases CVE-2014-2356GHSA-p4h7-mjq9-xwq7

Innominate mGuard Exposure of Sensitive Information to an Unauthorized Actor

Priority LOW 29CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

Why it matters now

EPSS 0.03376 88th percentileScored 2026-11-07
Fix Fixed mGuard (Innominate): 7.6.4, 8.0.3, 8.1.0 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
InnominatemGuard4.0.0 – 8.0.27.6.4, 8.0.3, 8.1.0, 8.1.1Patch availableCNA
  • mGuard VendorInnominate Affected 4.0.0 – 8.0.2 Fixed in 7.6.4, 8.0.3, 8.1.0, 8.1.1 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:innominate:mguard_firmware:*:*:*:*:*:*:*:*up to 7.5.0VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:4.0.4:*:*:*:*:*:*:*4.0.4VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:4.2.3:*:*:*:*:*:*:*4.2.3VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:5.1.6:*:*:*:*:*:*:*5.1.6VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:6.0.2:*:*:*:*:*:*:*6.0.2VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:6.1.5:*:*:*:*:*:*:*6.1.5VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:7.1.1:*:*:*:*:*:*:*7.1.1VulnerableInnominate
  • cpe:2.3:o:innominate:mguard_firmware:*:*:*:*:*:*:*:* Versions up to 7.5.0 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:5.1.6:*:*:*:*:*:*:* Versions 5.1.6 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:6.1.5:*:*:*:*:*:*:* Versions 6.1.5 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:7.1.1:*:*:*:*:*:*:* Versions 7.1.1 Vulnerable ·Innominate
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:innominate:mguard_firmware:7.2.1:*:*:*:*:*:*:*7.2.1VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:7.3.1:*:*:*:*:*:*:*7.3.1VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:8.0.1:*:*:*:*:*:*:*8.0.1VulnerableInnominate
cpe:2.3:o:innominate:mguard_firmware:8.0.2:*:*:*:*:*:*:*8.0.2VulnerableInnominate
  • cpe:2.3:o:innominate:mguard_firmware:7.2.1:*:*:*:*:*:*:* Versions 7.2.1 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:7.3.1:*:*:*:*:*:*:* Versions 7.3.1 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Innominate
  • cpe:2.3:o:innominate:mguard_firmware:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Innominate

Remediation

  • Fix · CNA mGuard (Innominate) Fixed in 7.6.4, 8.0.3, 8.1.0, 8.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-2356
  2. 2026-10-03 Alias added: GHSA-p4h7-mjq9-xwq7

References

Advisory 1

Other 1

  • TI-2014-07461 Innominate mGuard Improper Privilege Management CVSS 2.0HIGH 9.0
  • TI-2012-02609 The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard… CVSS 2.0HIGH 7.1
  • TI-2015-03352 The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before… CVSS 2.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences