CVE-2014-7989 Command injection in n/a
Local attackers can gain shell privileges on Cisco UCS B-Series blade servers by exploiting crafted ping6 or traceroute6 commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-7989?
CVE-2014-7989 is a medium-severity command injection vulnerability in n/a, published on 7 Nov 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cisco Unified Computing System on B-Series blade servers allows local users to gain shell privileges via a crafted (1) ping6 or (2) traceroute6 command, aka Bug ID CSCuq38176.
Weakness: CWE-20
Which versions are affected by CVE-2014-7989?
It affects 8 products.
Products include Cisco B200 M3, Cisco B200 M4, Cisco B22 M3, Cisco B230 M2, Cisco B260 M4, Cisco B420 M3 and 2 more.
How do I fix CVE-2014-7989?
No fix has been published for CVE-2014-7989 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2014-7989 being exploited?
There is no known exploitation of CVE-2014-7989 in the wild and no public exploit code.
Sources
Also known as GHSA-x9gv-2wp3-5fc7.