CVE-2009-4646

Severity: critical (CVSS 9.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-02-19 · updated 2026-06-16
Weakness: CWE-94

Description

Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string.

Affected products

Accellion Secure File Transfer Appliance: all versions

References

http://secunia.com/advisories/38538
http://www.portcullis-security.com/339.php
http://secunia.com/advisories/38538
http://www.portcullis-security.com/339.php

Get alerted when CVE-2009-4646 or the next vulnerability affects your stack