CVE-2014-9754: The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not valid...

Security readout for executives and security teams

This CVE describes a Viprinet MultichannelVPN Router 300 hardware VPN client that starts VPN communication without confirming the remote endpoint's SSL key. If an attacker can sit between the router and its VPN endpoint, they could impersonate the endpoint and intercept or alter traffic. Exposure appears limited to organizations still using Viprinet MultichannelVPN Router 300 devices on firmware 2013070830 or 2013080900. Risk is most relevant where VPN traffic crosses networks where an attacker could control routing, DNS, access links, or upstream infrastructure. Treat this as a targeted infrastructure risk, not a broad internet worm scenario. Prioritize if these legacy Viprinet routers protect sensitive sites, branch connectivity, or regulated data flows. Lack of patch information raises urgency to confirm vendor support or plan retirement. Mitigation focus: Inventory Viprinet MultichannelVPN Router 300 deployments and firmware versions.; Check Viprinet or current vendor guidance for fixed firmware or replacement direction.; Remove affected firmware from production if vendor remediation cannot be confirmed..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.