CVE-2014-6271

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 126 exploits · weaponized

Likely / severe?

100.0% (100th) EPSS

CVSS 10 · high

Is it mine?

252 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

added 2022-01-28remediate by 2022-07-28

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-23

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationABB Tropos 3000, 4000, 6000, & 7000 series routerscisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationABB Ventyx NM EMS/SCADA on RHEL Ventyxcisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationMeinberg LANTIMEcisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationMoxa Linux-based computerscisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationRed Lion RAM 9000, RAM 6000, SN 6000 and M, A and R Seriescisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationRed Lion Sixnet BT-5000 and 6000 Seriescisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationSiemens APE Linux with ELAN installedcisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationSiemens ROX 2cisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationSiemens ROX 1cisa_csaf_ot
As bash may be used as a third-party component, asset owners, operators, and ICS software developers are encouraged to investigate the use of the affected versions of bash in their environments.
MitigationEKI-132x platform devicescisa_csaf_ot
Update to the latest version. (http://support.advantech.com.tw/Support/SearchResult.aspx?keyword=EKI-132*&searchtabs=Firmware)
http://support.advantech.com.tw/Support/SearchResult.aspx?keyword=EKI-132*&searchtabs=Firmware

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.8–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 10 · impact 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v2.010criticalAV:N/AC:L/Au:N/C:C/I:C/A:Csecondary · FSTEC (BDU) RU

v2.010criticalAV:N/AC:L/Au:N/C:C/I:C/A:Csecondary · CISA US

v3.010criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USprimaryCWE-78USCWE-78US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (126)

Public proof-of-concept and weaponised exploit code.

exploit/linux/http/advantech_switch_bash_env_execAdvantech Switch Bash Environment Variable Code Injection (Shellshock)weaponized · metasploit
exploit/linux/http/ipfire_bashbug_execIPFire Bash Environment Variable Injection (Shellshock)weaponized · metasploit
exploit/multi/ftp/pureftpd_bash_env_execPure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)weaponized · metasploit
exploit/multi/http/apache_mod_cgi_bash_env_execApache mod_cgi Bash Environment Variable Code Injection (Shellshock)weaponized · metasploit
exploit/multi/http/cups_bash_env_execCUPS Filter Bash Environment Variable Code Injection (Shellshock)weaponized · metasploit
exploit/unix/dhcp/bash_environmentDhclient Bash Environment Variable Injection (Shellshock)weaponized · metasploit

affected products (252)

Products and version ranges known to be affected.

showing 20 of 252

advisories (2)

Vendor and ecosystem advisories describing this.

ICSA-14-269-01ABash Command Injection Vulnerability2014-06-29icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
ICSA-15-344-01BAdvantech EKI Vulnerabilities (Update B)2015-09-12icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

also known as (35)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot NVD CVE.org MITRE

published 2014-09-24modified 2026-07-06

related (7,913)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-106931US	—OT critical	1.17% (67th)	KEV	2026-10-14
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system r…
CVE-2026-105134US	critical10.0OT critical	38.3% (99th)	KEV	2026-10-04
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Ex…
CVE-2026-83549US	—OT critical	9.89% (96th)	KEV	2026-09-01
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management…
CVE-2026-74233US	critical9.8OT critical	3.37% (89th)	—	2026-08-27
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516,…
CVE-2026-73570US	—OT critical	71.7% (99th)	KEV	2026-08-13
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due…

+7908 more

references (512)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan