CVE-2014-6287
KEVCRITICAL 9.8EPSS 99.3%
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 99.32% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2022-03-25
- Nuclei
- critical · CWE-94
- Published
- 2014-10-07
- Updated
- 2025-10-22
Proof-of-concept exploits (21)
- http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution…
- http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Ex…
- http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-E…
- http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execut…
- 10cks/CVE-2014-62870★ · 2023-09-16
- Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-62871★ · 2021-02-20
- SlizBinksman/THM-Steel_Mountain-CVE-2014-62870★ · 2021-12-02
- Z3R0-0x30/CVE-2014-62870★ · 2025-06-20
- francescobrina/hfs-cve-2014-6287-exploit0★ · 2024-11-24
- mrintern/thm_steelmountain_CVE-2014-62871★ · 2021-12-03
- nika0x38/CVE-2014-62870★ · 2025-09-18
- rahisec/rejetto-http-file-server-2.3.x-RCE-exploit-CVE-2014-62870★ · 2025-07-11
- randallbanner/Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution2★ · 2023-04-04
- roughiz/cve-2014-6287.py0★ · 2022-10-22
- sage954526/HFS_EXPLOIT_PROJECT0★ · 2025-06-25
- thepedroalves/HFS-2.3-RCE-Exploit5★ · 2022-07-10
- wizardy0ga/THM-Steel_Mountain-CVE-2014-62870★ · 2021-12-02
- zhsh9/CVE-2014-62870★ · 2024-03-06
- JoaZ94/rejjeto_hfs-rce-exploit-cve-2014-62870★ · 2025-12-07
- Z3R0space/CVE-2014-62870★ · 2025-06-20
- jagg3rsec/CVE-2014-62870★ · 2026-01-25
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/39161
- https://www.exploit-db.com/exploits/34926
- https://www.exploit-db.com/exploits/34668
- https://www.exploit-db.com/exploits/49125