CVE-2014-9222: allegrosoft rompager DEPRECATED: Code

EPSS trend

Probability

74.01%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+10.26 pp

From 63.75% on 20-09-2026

20-09-202620-10-2026

EPSS score

74.01%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

MetasploitremoteUnverified
Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Authentication Bypass
auxiliary/admin/http/allegro_rompager_auth_bypass
Maturity: poc
MetasploitremoteUnverified
Allegro Software RomPager 'Misfortune Cookie' (CVE-2014-9222) Scanner
auxiliary/scanner/http/allegro_rompager_misfortune_cookie
Maturity: poc

References

6 links

mis.fortunecook.ieX Refsource MISCTechnical DescriptionThird Party Advisory
www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-407666.htmX Refsource CONFIRMVendor Advisory
www.securityfocus.com/bid/105173VDB EntryX Refsource BID
www.allegrosoft.com/allegro-software-urges-manufacturers-to-maintain-firmware-for-highest-level-of-embedded-device-security/…X Refsource CONFIRMThird Party Advisory
seclists.org/fulldisclosure/2014/Dec/87Mailing ListX Refsource FULLDISCThird Party Advisory
www.kb.cert.org/vuls/id/561444Third Party AdvisoryX Refsource CERT VNUS Government Resource

Related vulnerabilities

CVE-2013-6786allegrosoftrompager+62.17%12y ago16-01-2014 19:00Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.CVE-2014-9223allegrosoftrompager6.08%11y ago24-12-2014 18:00Multiple buffer overflows in AllegroSoft RomPager, as used in Huawei Home Gateway products and other vendors and products, allow remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors related to authorization.CVE-2024-0522allegrorompager+10.24%2y ago14-01-2024 23:00A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 4.30 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-250692. NOTE: The vendor explains that this is a very old issue that got fixed 20 years ago but without a public disclosure.

All vulnerabilities inrompager

CVE-2014-9222: allegrosoft rompager DEPRECATED: Code

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References