CVE-2014-9578: VDG Security SENSE (formerly DIVA) 2.3.13 performs authentication with a password hash instead of a passwor...

Security readout for executives and security teams

VDG Security SENSE, formerly DIVA, 2.3.13 reportedly accepts a password hash as if it were the real password. If an attacker obtains a user’s hash, they may log in remotely without knowing the password. This is serious for systems managing security operations, but the bundle does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely where VDG Security SENSE/DIVA 2.3.13 remains deployed and reachable over a network, especially if password hashes were disclosed through other weaknesses, backups, logs, or configuration access. The bundle names only version 2.3.13, so broader product exposure is not established. Treat this as high priority if the product is still deployed. Unauthorized access to a security management platform can create operational and physical-security risk. Because public sources do not name a patch in this bundle, prioritize exposure reduction, vendor confirmation, and retirement of unsupported instances. Mitigation focus: Check VDG Security/vendor guidance for fixed versions or supported upgrade paths.; Restrict SENSE/DIVA access to trusted admin networks or VPN-only paths.; Rotate credentials after remediation if password hashes may have been exposed..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.