What is CVE-2015-0941?

CVE-2015-0941 is a vulnerability in Inetc Project, classified under Cryptographic Issues. Published 2015-03-22.

Is CVE-2015-0941 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Inetc Project

CVE-2015-0941

The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.014 (69.5th percentile) — read the EPSS interpretation.

Affected products

Inetc_project Inetc
N/a — versions n/a

Weakness classification (CWE)

CWE-310 — Cryptographic Issues

Public proof-of-concept exploits

GitHubAssessments/CVE_

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2015-0941?: CVE-2015-0941 is a vulnerability in Inetc Project, classified under Cryptographic Issues. Published 2015-03-22.
Is CVE-2015-0941 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.