CVE-2014-2850

The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.

CVSS v2.0 NVD

8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

57.57% chance of exploitation in the next 30 days, 99th percentile

Published

2014-04-11

Updated

2024-09-16

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/32789

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sophos_wpa_iface_exec…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/32789

Security advisories

• http://secunia.com/advisories/57706
• http://www.sophos.com/en-us/support/knowledgebase/120230.aspx
• http://www.securityfocus.com/bid/66734

References

• CVE Record
• NVD entry