$ cve CVE-2014-4977 JSON

CVE-2014-4977 EXPLOIT

6.5

MEDIUM · CVSS 2.0 · EPSS 74.9% (pctl 99)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php.

Scoring

CVSS	6.5 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS	74.93% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2014-07-16
Last modified	2026-06-17

Affected (1)

Vendor	Product
sonicwall	scrutinizer

Public exploits

Source	Title	Date
exploit-db	Dell SonicWALL Scrutinizer 11.01 - methodDetail SQL Injection (Metasploit)	2016-05-17

References

→ the Explorer · watch your stack · NVD