---
id: CVE-2014-125001
title: Cardo Systems Scala Rider Q3 Cardo-Updater api privileges management
summary: >-
  A vulnerability classified as critical has been found in Cardo Systems Scala
  Rider Q3. Affected is the file /cardo/api of the Cardo-Updater.
  Unauthenticated remote code execution with root permissions is possible.
  Firewalling or disablin…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-269
vendor: Cardo Systems
product: Scala Rider Q3
affected:
  - scala_rider_q3 n/a
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-04-14T16:55:41.321979Z'
exploitAvailable: true
published: '2022-05-24'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:00:56.001Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2014-125001'
references:
  - url: 'http://www.remote-exploit.org/archives/2014/06/03/ride_with_the_devil/'
  - url: 'https://vuldb.com/?id.13428'
tags:
  - cve.org
  - exploit-available
epss: 0.0393
epssPercentile: 0.90419
ingestedAt: '2026-11-05T20:33:06.375Z'
---

## Overview

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api of the Cardo-Updater. Unauthenticated remote code execution with root permissions is possible. Firewalling or disabling the service is recommended.

## Affected

- `scala_rider_q3 n/a`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.