CVE-2014-2850

Public PoC / Exploit (1)

Exploit-DBSophos Web Protection Appliance Interface - (Authenticated) Arbitrary Command Execution (Metasploit)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.

Weaknesses (CWE)

CWE-78

Affected Products (79)

sophos · web_appliance_firmwarevulnerable

...and 29 more

References (10)

http://secunia.com/advisories/57706

Vendor Advisory

http://www.exploit-db.com/exploits/32789

Exploit

http://www.securityfocus.com/bid/66734

http://www.sophos.com/en-us/support/knowledgebase/120230.aspx

Vendor Advisory

http://www.zerodayinitiative.com/advisories/ZDI-14-069/

http://secunia.com/advisories/57706

Vendor Advisory

http://www.exploit-db.com/exploits/32789

Exploit

http://www.securityfocus.com/bid/66734

http://www.sophos.com/en-us/support/knowledgebase/120230.aspx

Vendor Advisory

http://www.zerodayinitiative.com/advisories/ZDI-14-069/