CVE-2014-7249

Name of the Vulnerable Software and Affected Versions Allied Telesis AR440S versions prior to 2.9.1-21 Allied Telesis AR441S versions prior to 2.9.1-21 Allied Telesis AR442S versions prior to 2.9.1-21 Allied Telesis AR745 versions prior to 2.9.1-21 Allied Telesis AR750S versions prior to 2.9.1-21 Allied Telesis AR750S-DP versions prior to 2.9.1-21 Allied Telesis AT-8624POE versions prior to 2.9.1-21 Allied Telesis AT-8624T/2M versions prior to 2.9.1-21 Allied Telesis AT-8648T/2SP versions prior to 2.9.1-21 Allied Telesis AT-8748XL versions prior to 2.9.1-21 Allied Telesis AT-8848 versions prior to 2.9.1-21 Allied Telesis AT-9816GB versions prior to 2.9.1-21 Allied Telesis AT-9924T versions prior to 2.9.1-21 Allied Telesis AT-9924Ts versions prior to 2.9.1-21 CentreCOM AR415S versions prior to 2.9.1-21 CentreCOM AR450S versions prior to 2.9.1-21 CentreCOM AR550S versions prior to 2.9.1-21 CentreCOM AR570S versions prior to 2.9.1-21 CentreCOM 8700SL versions prior to 2.9.1-21 CentreCOM 8948XL versions prior to 2.9.1-21 CentreCOM 9924SP versions prior to 2.9.1-21 CentreCOM 9924T/4SP versions prior to 2.9.1-21 Rapier 48i versions prior to 2.9.1-21 SwitchBlade4000 versions prior to 2.9.1-21

Description The issue is a buffer overflow that allows remote attackers to execute arbitrary code via a crafted HTTP POST request.

Recommendations Update the firmware to version 2.9.1-21 or later for all affected devices. As a temporary workaround, consider restricting access to the HTTP POST request endpoint until the firmware update is applied. Avoid using the vulnerable firmware versions until the issue is resolved by updating to the latest firmware.