CyberSec.Space Logo
Back to CVE Browser

CVE-2014-3418

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.1150%
EPSS Percentile37.35th
PublishedJul 15, 2014
Last ModifiedMay 6, 2026

Vulnerability Description

config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter.

Affected Platforms (CPE)

📦
Infoblox

Netmri

<= 6.8.4
📦
Infoblox

Netmri

= 6.0.2.42
📦
Infoblox

Netmri

= 6.1.2
📦
Infoblox

Netmri

= 6.2.1
📦
Infoblox

Netmri

= 6.2.1.48
📦
Infoblox

Netmri

= 6.8.2.11

References & Advisories

🔗 http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html
🔗 http://seclists.org/fulldisclosure/2014/Jul/35
🔗 http://www.exploit-db.com/exploits/34030
🔗 http://www.securityfocus.com/archive/1/532709/100/0/threaded
🔗 http://www.securityfocus.com/bid/68471
🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/94449
🔗 https://github.com/depthsecurity/NetMRI-2014-3418
🔗 http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html

Related Vulnerabilities

CVE-2015-203310.0

Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands wit...

CVE-2014-34197.2

Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for loca...

CVE-2018-66436.1

Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter.

CVE-2016-64846.1

CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP h...