PatchSiren

PatchSiren cyber security CVE debrief

CVE-2014-9755 Viprinet CVE debrief

CVE-2014-9755 affects Viprinet MultichannelVPN Router 300 firmware versions 2013070830 and 2013080900. The hardware VPN client does not validate the remote VPN endpoint’s identity by checking the endpoint SSL key before starting the exchange, which can allow a remote attacker to replay traffic or session material. The NVD record maps the issue to CWE-20 (Improper Input Validation) and rates it HIGH. Public references in the supplied corpus include a Packet Storm advisory and a Full Disclosure post, while the CVE record itself was published on 2017-01-20 and later modified on 2026-05-13.

Vendor
Viprinet
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-20
Original CVE updated
2026-05-13
Advisory published
2017-01-20
Advisory updated
2026-05-13

Who should care

Organizations using Viprinet MultichannelVPN Router 300 appliances with firmware 2013070830 or 2013080900, especially teams responsible for VPN infrastructure, network security, and remote-access operations.

Technical summary

The vulnerable VPN client initiates a VPN exchange without verifying the remote endpoint’s SSL key, so it does not reliably authenticate the peer identity first. That identity-check failure can let an attacker on the network path abuse replay conditions against the VPN flow. NVD assigns CWE-20 and lists affected CPE entries for the two firmware versions noted above.

Defensive priority

High priority for environments that still operate the affected firmware, because the issue is network-reachable, requires no privileges or user interaction, and affects a core remote-access component.

Recommended defensive actions

  • Confirm whether any Viprinet MultichannelVPN Router 300 devices are running firmware 2013070830 or 2013080900.
  • Review the vendor’s guidance and any available firmware updates or corrective releases for the affected hardware.
  • If upgrading is not immediately possible, reduce exposure by restricting who can reach the VPN endpoint and by limiting reliance on the affected tunnel path.
  • Monitor VPN logs for unusual repeated session attempts or traffic patterns that could indicate replay-related abuse.
  • Validate that endpoint identity checks are enforced in your deployment and document any compensating controls used until remediation is complete.

Evidence notes

All claims are limited to the supplied NVD-derived corpus and linked references. The description states the VPN client does not validate the remote endpoint identity by checking the endpoint SSL key before the exchange, enabling replay attacks. NVD lists vulnerable firmware versions 2013070830 and 2013080900 and classifies the weakness as CWE-20. The reference set includes Packet Storm, Full Disclosure, and SecurityFocus entries; no vendor patch text was included in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2014-9755 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2014-9755

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2014-9755 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2014-9755

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.