CVE-2014-7285 EXPLOIT
6.5
MEDIUM · CVSS 2.0 · EPSS 50.3% (pctl 99)
Patch early
A public exploit exists.
Description
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.
Scoring
| CVSS | 6.5 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| EPSS | 50.32% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-77 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-12-17 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| symantec | web gateway |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Symantec Web Gateway 5 - 'restore.php' (Authenticated) Command Injection (Metasploit) | 2015-03-04 |
References
- http://karmainsecurity.com/KIS-2014-19
- http://osvdb.org/show/osvdb/116009
- http://packetstormsecurity.com/files/130612/Symantec-Web-Gateway-5-restore.php-Command-Injection.html
- http://www.exploit-db.com/exploits/36263
- http://www.securityfocus.com/bid/71620
- http://www.securitytracker.com/id/1031386
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141216_00
- http://karmainsecurity.com/KIS-2014-19
- http://osvdb.org/show/osvdb/116009
- http://packetstormsecurity.com/files/130612/Symantec-Web-Gateway-5-restore.php-Command-Injection.html
- http://www.exploit-db.com/exploits/36263
- http://www.securityfocus.com/bid/71620
- http://www.securitytracker.com/id/1031386
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141216_00
→ the Explorer · watch your stack · NVD