Skip to content
Fencer Intel
high 7.6

CVE-2014-9196 json

Eaton’s Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet

published 2015-07-20 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-9021

cvss
7.6
version 2.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-15-006-01 updated cvss 7.6

Eaton Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet Vulnerability

  • Eaton Cooper Power Systems Eaton’s Cooper Power Series Form 6 control and Idea/IdeaPLUS relays with Ethernet with Pro View 4.0 through Pro View 5.0 software
    affected: mitigation “For additional technical information, please contact Eaton’s Cooper Power Systems at: (http://www.eaton.com/cybersecurity)”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.49% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 2.0 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Eaton’s Cooper Power Systems Series Form 6
  • Eaton’s Cooper Power Systems Idea/IdeaPLUS relays

Classification

Weakness
  • CWE-342 Predictable Exact Value from Previous Values
  • CWE-254 7PK - Security Features

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.