CVE-2014-1693 Command injection in n/a
Attackers can inject arbitrary FTP commands via CRLF sequences in Erlang/OTP FTP module functions, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-1693?
CVE-2014-1693 is a high-severity command injection vulnerability in n/a, published on 8 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.
Which versions are affected by CVE-2014-1693?
It affects 1 product.
Products include Erlang Erlang\/Otp.
How do I fix CVE-2014-1693?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2014-1693 being exploited?
There is no known exploitation of CVE-2014-1693 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-37026 Auth bypass in n/a
- CVE-2016-10253 Memory corruption in n/a
- CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-49759 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
- CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
Sources
Also known as DEBIAN-CVE-2014-1693, GHSA-q3fq-w858-v26f, MGASA-2014-0553, UBUNTU-CVE-2014-1693.