Security readout for executives and security teams
Plain-English summary
This vulnerability lets text sent into an Opengear console server serial port be stored in logs and later executed as script when someone views those logs. It matters most where console servers manage sensitive infrastructure, but exploitation requires serial-port access or console-server access and logging enabled.
Executive priority
Treat this as a targeted management-plane risk, not an internet-scale emergency based on available evidence. Prioritize firmware review and upgrade for console servers managing critical infrastructure or reachable by less-trusted serial-connected systems.
Technical view
Opengear console server firmware before 4.5.0 has stored XSS in serial port logging. Crafted serial input can be logged and replayed in the web log viewer. The source bundle provides no CVSS, CWE, detailed affected model list, or evidence of active exploitation.
Likely exposure
Organizations using Opengear console servers running firmware earlier than 4.5.0, with serial port logging enabled, are the likely exposed group. Risk is higher when untrusted or compromised external systems connect to serial ports and administrators review logs in a browser.
Exploitation context
CISA KEV status is false in the bundle, and no cited source states active exploitation. Practical exploitation requires access to a serial port, a connected external system, or the console server, plus a user viewing affected logs.
Researcher notes
The key condition is stored content moving from serial input into a browser-rendered log view. Evidence is limited to the CVE record and Opengear advisory reference; model-level scope, CVSS, CWE classification, and exploit-in-the-wild details are not provided.
Mitigation direction
- Upgrade affected Opengear console server firmware to 4.5.0 or later if vendor guidance confirms applicability.
- Review Opengear's advisory for exact product and firmware applicability.
- Restrict access to console server management interfaces and log viewers.
- Limit serial-port access to trusted systems and administrators.
- Disable serial port logging where it is not operationally required.
Validation and detection
- Inventory Opengear console servers and record firmware versions.
- Identify serial ports with logging enabled.
- Confirm whether any device runs firmware earlier than 4.5.0.
- Verify log viewer access is limited to trusted administrators.
- Review serial logs for unexpected script-like content without executing it.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-14456 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://opengear.zendesk.com/hc/en-us/articles/360029189391-Stored-cross-site-scripting-XSS-vulnerability-in-serial-port-loggingCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.