CVE-2014-7889 - Vulnerability Details - OpenCVE

The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSLineDisplay.ocx for Retail RP7 VFD Customer Display monitors, Retail Integrated 2x20 Display monitors, Retail Integrated 2x20 Complex monitors, POS Pole Display monitors, Graphical POS Pole Display monitors, and LCD Pole Display monitors, aka ZDI-CAN-2511.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hp	Graphical Pos Pole Display Qz704aa Lcd Pole Display F7a93aa Ole Point Of Sale Driver Pos Pole Display Fk225aa Retail Integrated 2x20 Complex G7g29aa Retail Integrated 2x20 Display G6u79aa Retail Rp7 Vfd Customer Display Qz701aa

Configuration 1 [-]

AND

cpe:2.3:a:hp:ole_point_of_sale_driver:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:hp:graphical_pos_pole_display_qz704aa::::::::
	cpe:2.3:h:hp:lcd_pole_display_f7a93aa::::::::
	cpe:2.3:h:hp:pos_pole_display_fk225aa::::::::
	cpe:2.3:h:hp:retail_integrated_2x20_complex_g7g29aa::::::::
	cpe:2.3:h:hp:retail_integrated_2x20_display_g6u79aa::::::::
	cpe:2.3:h:hp:retail_rp7_vfd_customer_display_qz701aa::::::::

No data.

References

Link	Providers
http://www.securitytracker.com/id/1031840
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185

History

No history.

MITRE

Status: PUBLISHED

Assigner: hp

Published: 2015-03-09T17:00:00

Updated: 2024-08-06T13:03:27.647Z

Reserved: 2014-10-06T00:00:00

Link: CVE-2014-7889

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2015-03-09T17:59:01.877

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-7889

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-03-04T00:00:00", "descriptions": [{"lang": "en", "value": "The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSLineDisplay.ocx for Retail RP7 VFD Customer Display monitors, Retail Integrated 2x20 Display monitors, Retail Integrated 2x20 Complex monitors, POS Pole Display monitors, Graphical POS Pole Display monitors, and LCD Pole Display monitors, aka ZDI-CAN-2511."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2015-03-10T13:57:00", "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp"}, "references": [{"name": "SSRT101695", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}, {"name": "1031840", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1031840"}, {"name": "HPSBHF03279", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "hp-security-alert@hp.com", "ID": "CVE-2014-7889", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSLineDisplay.ocx for Retail RP7 VFD Customer Display monitors, Retail Integrated 2x20 Display monitors, Retail Integrated 2x20 Complex monitors, POS Pole Display monitors, Graphical POS Pole Display monitors, and LCD Pole Display monitors, aka ZDI-CAN-2511."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "SSRT101695", "refsource": "HP", "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}, {"name": "1031840", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1031840"}, {"name": "HPSBHF03279", "refsource": "HP", "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:03:27.647Z"}, "title": "CVE Program Container", "references": [{"name": "SSRT101695", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}, {"name": "1031840", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1031840"}, {"name": "HPSBHF03279", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}]}]}, "cveMetadata": {"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "assignerShortName": "hp", "cveId": "CVE-2014-7889", "datePublished": "2015-03-09T17:00:00", "dateReserved": "2014-10-06T00:00:00", "dateUpdated": "2024-08-06T13:03:27.647Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hp:ole_point_of_sale_driver:*:*:*:*:*:*:*:*", "matchCriteriaId": "F3BD6000-9ED7-4A61-A45D-030F2E428404", "versionEndIncluding": "1.13.001", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:hp:graphical_pos_pole_display_qz704aa:*:*:*:*:*:*:*:*", "matchCriteriaId": "024AB978-5A39-437E-B31D-F4ABD36DEE5D", "vulnerable": false}, {"criteria": "cpe:2.3:h:hp:lcd_pole_display_f7a93aa:*:*:*:*:*:*:*:*", "matchCriteriaId": "94F7D892-C9AC-4DC2-B748-ABF64BE19035", "vulnerable": false}, {"criteria": "cpe:2.3:h:hp:pos_pole_display_fk225aa:*:*:*:*:*:*:*:*", "matchCriteriaId": "F24BEE46-3163-4D5C-8D70-C244C8ACFE13", "vulnerable": false}, {"criteria": "cpe:2.3:h:hp:retail_integrated_2x20_complex_g7g29aa:*:*:*:*:*:*:*:*", "matchCriteriaId": "A76965AE-E5A7-4BBC-9863-7261EFC18BD7", "vulnerable": false}, {"criteria": "cpe:2.3:h:hp:retail_integrated_2x20_display_g6u79aa:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE0C5BFC-37B3-43A0-8C73-04F194001839", "vulnerable": false}, {"criteria": "cpe:2.3:h:hp:retail_rp7_vfd_customer_display_qz701aa:*:*:*:*:*:*:*:*", "matchCriteriaId": "53899767-8250-4BDE-92F2-26C8B07D7E52", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSLineDisplay.ocx for Retail RP7 VFD Customer Display monitors, Retail Integrated 2x20 Display monitors, Retail Integrated 2x20 Complex monitors, POS Pole Display monitors, Graphical POS Pole Display monitors, and LCD Pole Display monitors, aka ZDI-CAN-2511."}, {"lang": "es", "value": "Los controladores OLE Point of Sale (OPOS) anterior a 1.13.003 en los PCs de Windows HP Point of Sale permiten a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores que involucran OPOSLineDisplay.ocx para los monitores Retail RP7 VFD Customer Display, Retail Integrated 2x20 Display, Retail Integrated 2x20 Complex, POS Pole Display, Graphical POS Pole Display, y LCD Pole Display , tambi\u00e9n conocido como ZDI-CAN-2511."}], "id": "CVE-2014-7889", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-03-09T17:59:01.877", "references": [{"source": "hp-security-alert@hp.com", "url": "http://www.securitytracker.com/id/1031840"}, {"source": "hp-security-alert@hp.com", "tags": ["Vendor Advisory"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}, {"source": "hp-security-alert@hp.com", "tags": ["Vendor Advisory"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1031840"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185"}], "sourceIdentifier": "hp-security-alert@hp.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}