What’s Vulnerable › Vulnerabilities

CVE-2014-5502

• Severity: critical (CVSS 9.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-10-07 · updated 2026-06-17
• Weakness: CWE-78

Description

The Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote authenticated users to inject arbitrary commands via a (1) checkcert_key, (2) webclient_portal_settings, (3) sslvpn_liveuser_delete, or (4) ccc_flush_sql_file opcode.

Affected products

• Cyberoam Os: through 10.4; through 10.6.1

References

• http://kb.cyberoam.com/default.asp?id=3049
• http://www.zerodayinitiative.com/advisories/ZDI-14-328/
• http://www.zerodayinitiative.com/advisories/ZDI-14-331/
• http://www.zerodayinitiative.com/advisories/ZDI-14-332/
• http://www.zerodayinitiative.com/advisories/ZDI-14-333/
• http://kb.cyberoam.com/default.asp?id=3049
• http://www.zerodayinitiative.com/advisories/ZDI-14-328/
• http://www.zerodayinitiative.com/advisories/ZDI-14-331/
• http://www.zerodayinitiative.com/advisories/ZDI-14-332/
• http://www.zerodayinitiative.com/advisories/ZDI-14-333/

Get alerted when CVE-2014-5502 or the next vulnerability affects your stack