CyberSec.Space Logo
Back to CVE Browser

CVE-2014-5502

CRITICAL
9.0
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2014-10-07
Last Modified2026-05-06
Data SourcesNVD

Vulnerability Description

The Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote authenticated users to inject arbitrary commands via a (1) checkcert_key, (2) webclient_portal_settings, (3) sslvpn_liveuser_delete, or (4) ccc_flush_sql_file opcode.

Affected Platforms (CPE)

💻
Cyberoam

Cyberoam Os

<= 10.4<= 10.6.1

References & Advisories

🔗 http://kb.cyberoam.com/default.asp?id=3049
🔗 http://www.zerodayinitiative.com/advisories/ZDI-14-328/
🔗 http://www.zerodayinitiative.com/advisories/ZDI-14-331/
🔗 http://www.zerodayinitiative.com/advisories/ZDI-14-332/
🔗 http://www.zerodayinitiative.com/advisories/ZDI-14-333/
🔗 http://kb.cyberoam.com/default.asp?id=3049
🔗 http://www.zerodayinitiative.com/advisories/ZDI-14-328/
🔗 http://www.zerodayinitiative.com/advisories/ZDI-14-331/

Related Vulnerabilities

CVE-2020-370959.8

Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary ...

CVE-2021-387026.1

Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.

CVE-2020-295749.8

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbit...

CVE-2019-170599.8

A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attacke...