Unscored severity · published Apr 11, 2014
CVE-2014-1209
VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the…
–
CVSS
3.8%
EPSS
No
On KEV
Description
VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VC
Vsphere Client · Vmware
4.0; 4.1; 5.0; 5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1209
Vendor Advisory
http://www.vmware.com/security/advisories/VMSA-2014-0003.html
More from Vsphere Client
5.8
CVE-2016-7458
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity…
–
CVE-2014-1210
VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via…
–
CVE-2013-1405
VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware…