Innominate mGuard Unauthorized Leakage of System Data

Vulnerabilities 1

• Medium 4.3
  CVE-2014-2356

  Innominate mGuard Exposure of Sensitive Information to an Unauthorized Actor

  Innominate mGuard before 7.6.4 and 8.x before 8.0.3 does not require authentication for snapshot downloads, which allows remote attackers to obtain sensitive information via a crafted HTTPS request.

  Innominate mGuard
  Jul 30, 2014

Revision history

1. 2025-06-06 #2

   Advisory converted into a CSAF

2. 2014-04-10 #1

   Initial Publication

References

• ICS Advisory ICSA-14-189-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-14-189-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014