CVE-2014-3931KEV · OVERDUE

Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability

Critical · published March 31, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 98.2th percentile for exploit probability.

452
days past CISA
deadline
CVSS v3.1
9.8
EPSS
29%
Percentile
98.2
In the wild
Confirmed
What it is

🚨 An arbitrary memory write vulnerability in MRLG can let attackers wreak havoc — like a kid with a crayon letting loose on your home’s blueprints! 🔥 Think of this vulnerability as an unauthorized architect who can scribble over your building plans. They could rewrite sections, causing structural chaos without you even noticing until it’s too late! This could lead to devastating memory corruption, giving attackers the keys to modify critical parts of the system. They could crash services, manipulate data, or even escalate privileges to take complete control. Imagine someone rewriting the rules of your favorite game mid-play; it’s that disruptive!

Put simply

Think of this vulnerability as an unauthorized architect who can scribble over your building plans. They could rewrite sections, causing structural chaos without you even noticing until it’s too late! The flaw resides in the fastping.c code in MRLG versions prior to 5.5.0, allowing attackers to perform unauthorized memory writes. This exploit can lead to a range of unexpected behaviors or crashes, undermining system integrity.

What to do

This could lead to devastating memory corruption, giving attackers the keys to modify critical parts of the system. They could crash services, manipulate data, or even escalate privileges to take complete control. Imagine someone rewriting the rules of your favorite game mid-play; it’s that disruptive! Immediate action is required! Upgrade MRLG to version 5.5.0 or later to patch this vulnerability. Additionally, review your configuration and access controls to minimize exposure to potential attacks. You've got this! With these steps, you’ll lock down your system like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.28978 · 98.2th percentile
Published
2017-03-31T15:00Z
KEV added
2025-07-07 · due 2025-07-28
EPSS history
Timeline
  • 07 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 28
    kev
  • 31 MAR 15:00Z
    fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption
    cvelistv5