CVE-2014-9222

AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory corruption, aka the "Misfortune Cookie" vulnerability.

Published: 2014-12-24 Last update: 2026-05-06 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Conclusion & alert: CVE-2014-9222 is rated High Risk (74.6/100): CVSS Critical severity, with high exploitation likelihood (EPSS 86.45%, 99th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2014-9222

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-23	86.60%	86.45%	-0.15%
2	2026-05-22	86.45%	86.60%	+0.15%
3	2026-04-18	—	86.45%	—

Full EPSS history (31 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2014-9222

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
10.0	2.0	HIGH	`AV:N/AC:L/Au:N/C:C/I:C/A:C` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:C) Complete confidentiality impact. Integrity impact (I:C) Complete integrity impact. Availability impact (A:C) Complete availability impact.	10.0	10.0	[email protected]

Weakness enumeration for CVE-2014-9222

CWE-17 MITRE ↗

Affected software / configurations for CVE-2014-9222

Vendor	Product	Version	Raw CPE
allegrosoft	rompager	<= 4.07	cpe:2.3:a:allegrosoft:rompager::::::::

References for CVE-2014-9222

URL	Tags
http://mis.fortunecook.ie/	Technical Description Third Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/87	Mailing List Third Party Advisory
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-407666.htm	Vendor Advisory
http://www.kb.cert.org/vuls/id/561444	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/105173
https://www.allegrosoft.com/allegro-software-urges-manufacturers-to-maintain-firmware-for-highest-level-of-embedded-device-security/news-press.html	Third Party Advisory

cvelogic Threat Intelligence