Unscored severity · published Oct 7, 2014
CVE-2014-5503
SQL injection vulnerability in the Guest Login Portal in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attackers to execute arbitrary SQL commands…
–
CVSS
2%
EPSS
No
On KEV
Description
SQL injection vulnerability in the Guest Login Portal in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attackers to execute arbitrary SQL commands via the add_guest_user opcode.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Cyberoam OS · Cyberoam
through 10.4; through 10.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5503
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5503
Vendor Advisory
http://kb.cyberoam.com/default.asp?id=3049
www.zerodayinitiative.com
http://www.zerodayinitiative.com/advisories/ZDI-14-329/
More from Cyberoam OS
–
CVE-2014-5502
The Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote authenticated users to inject arbitrary commands via a (1) checkcert_key, (2)…
–
CVE-2014-5501
Stack-based buffer overflow in the diagnose service in the Sophos Cyberoam appliances with CyberoamOS before 10.6.1 GA allows remote attackers to execute arbitrary code via a…