CVE-2014-2940: Cobham SAILOR 900/6000 VSAT Satellite Terminal Hardcoded Administrator Credentials

CVE-2014-2940 is a hardcoded-credentials vulnerability (CWE-798) in Cobham's SAILOR 900 and SAILOR 6000 series VSAT satellite terminals, the maritime satcomms equipment that provides many vessels' primary broadband link to shore: the administrator account's login is built into the firmware itself, so anyone with physical access to the terminal or a connection to its maintenance network segment can log in with full administrative control and no password needed, and NVD's own Primary analysis scores the flaw 10.0 (critical) on CVSS v2 — CERT/CC additionally states it is unaware of any practical fix.

CVE-2014-2940 (CWE-798, Use of Hard-coded Credentials) affects Cobham SAILOR 900 and SAILOR 6000 series satellite terminals, part of Cobham SATCOM's maritime VSAT and Inmarsat FleetBroadband product line. NVD's description states: "Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access" (NVD).

The issue was reported by security researcher Ruben Santamarta (IOActive) and tracked by CERT/CC as VU#460687. CERT/CC's vulnerability note records the plain impact: "A remote unauthenticated attacker may be able to gain full control over the device" (CERT/CC VU#460687). Cobham's own vendor statement, reproduced in full on that note, argues the practical risk is constrained: "potential exploitation of the vulnerabilities presented requires either physical access to the equipment or connectivity to the maintenance part of the network, which also requires a physical presence at the terminal," and that "Cobham devices can therefore only be subject to attacks if the attacker has either physical access to the device or segment or the network has been installed incorrectly" (CERT/CC VU#460687).

NVD has completed its own severity analysis for this CVE: the Primary score (source [email protected]) is CVSS v2 10.0 (the maximum possible on that scale), vector AV:N/AC:L/Au:N/C:C/I:C/A:C, reflecting a network attack vector with no authentication required and complete loss of confidentiality, integrity and availability once an attacker reaches the maintenance interface (NVD). CERT/CC's own CVSS v2 base score matches at 10.0, with a temporal score of 8.1 reflecting that proof-of-concept exploit code is known to exist.

CERT/CC's solution guidance is blunt: "The CERT/CC is currently unaware of a practical solution to this problem," and its vendor-status table lists Cobham plc as "Affected" with no fixed firmware version recorded as of CERT/CC's last update on 2014-08-14 (CERT/CC VU#460687).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.02215 (82.8th percentile) as of 2026-11-08, consistent with public proof-of-concept exploit code having existed for over a decade (CISA KEV, FIRST EPSS).

With no vendor patch on record, operators of affected SAILOR 900/6000 terminals should treat Cobham's own mitigation as the operative guidance: restrict physical access to the terminal and its maintenance port strictly to authorized personnel, and keep the maintenance network segment isolated from any network segment a non-authorized device could reach.

• Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, which allows attackers to obtain administrative control by leveraging physical access or terminal access. — NVD
• Reported by Ruben Santamarta (IOActive); a remote unauthenticated attacker may be able to gain full control over the device; Cobham states exploitation requires physical access or connectivity to the maintenance network segment. — CERT/CC VU#460687
• NVD's own Primary CVSS v2 score is 10.0, vector AV:N/AC:L/Au:N/C:C/I:C/A:C; CERT/CC records a matching 10.0 base score with an 8.1 temporal score reflecting known proof-of-concept exploit code; CERT/CC is unaware of any practical solution and records no fixed firmware version. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.02215 (82.8th percentile) as of 2026-11-08. — FIRST EPSS