Read the docs
TI-2014-06899 Aliases CVE-2014-8389GHSA-4xc5-wc24-8f5h

cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive…

Priority HIGH 74CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware LM.1.6.17.01 uses hard-coded credentials in the embedded Boa web server, which allows remote attackers to obtain user credentials via crafted HTTP requests.

Why it matters now

EPSS 0.51426 98th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:airlive:bu-3026_firmware:1.43_21.08.2014:*:*:*:*:*:*:*1.43_21.08.2014VulnerableAirlive
cpe:2.3:h:airlive:bu-3026:-:*:*:*:*:*:*:*not specified by NVDRunning onAirlive
cpe:2.3:o:airlive:md-3025_firmware:1.81_21.08.2014:*:*:*:*:*:*:*1.81_21.08.2014VulnerableAirlive
cpe:2.3:h:airlive:md-3025:-:*:*:*:*:*:*:*not specified by NVDRunning onAirlive
cpe:2.3:o:airlive:wl-2000cam_firmware:lm.1.6.18_14.10.2011:*:*:*:*:*:*:*lm.1.6.18_14.10.2011VulnerableAirlive
cpe:2.3:h:airlive:wl-2000cam:-:*:*:*:*:*:*:*not specified by NVDRunning onAirlive
cpe:2.3:o:airlive:poe-200cam_v2_firmware:lm.1.6.17.01:*:*:*:*:*:*:*lm.1.6.17.01VulnerableAirlive
cpe:2.3:h:airlive:poe-200cam_v2:-:*:*:*:*:*:*:*not specified by NVDRunning onAirlive
cpe:2.3:o:airlive:bu-2015_firmware:1.03.18_16.06.2014:*:*:*:*:*:*:*1.03.18_16.06.2014VulnerableAirlive
cpe:2.3:h:airlive:bu-2015:-:*:*:*:*:*:*:*not specified by NVDRunning onAirlive
  • cpe:2.3:o:airlive:bu-3026_firmware:1.43_21.08.2014:*:*:*:*:*:*:* Versions 1.43_21.08.2014 Vulnerable ·Airlive
  • cpe:2.3:h:airlive:bu-3026:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airlive
  • cpe:2.3:o:airlive:md-3025_firmware:1.81_21.08.2014:*:*:*:*:*:*:* Versions 1.81_21.08.2014 Vulnerable ·Airlive
  • cpe:2.3:h:airlive:md-3025:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airlive
  • cpe:2.3:o:airlive:wl-2000cam_firmware:lm.1.6.18_14.10.2011:*:*:*:*:*:*:* Versions lm.1.6.18_14.10.2011 Vulnerable ·Airlive
  • cpe:2.3:h:airlive:wl-2000cam:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airlive
  • cpe:2.3:o:airlive:poe-200cam_v2_firmware:lm.1.6.17.01:*:*:*:*:*:*:* Versions lm.1.6.17.01 Vulnerable ·Airlive
  • cpe:2.3:h:airlive:poe-200cam_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airlive
  • cpe:2.3:o:airlive:bu-2015_firmware:1.03.18_16.06.2014:*:*:*:*:*:*:* Versions 1.03.18_16.06.2014 Vulnerable ·Airlive
  • cpe:2.3:h:airlive:bu-2015:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airlive

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-8389
  2. 2026-10-03 Alias added: GHSA-4xc5-wc24-8f5h

References

Exploit 3

  • TI-2015-02016 cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and… CVSS 3.0CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences