CVE Daily

CVE-2014-125118

A command injection vulnerability exists in the eScan Web Management Console ver...

Critical CVSS 9.4

Overview

A command injection vulnerability exists in the eScan Web Management Console version 5.5-2. The application fails to properly sanitize the 'pass' parameter when processing login requests to login.php, allowing an authenticated attacker with a valid username to inject arbitrary commands via a specially crafted password value. Successful exploitation results in remote code execution. Privilege escalation to root is possible by abusing the runasroot utility with mwconf-level privileges.

CWE: CWE-78 Published: 2025-07-25T16:15:26.360
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.4 (CRITICAL)
  • Detected tags: command_injection, priv_esc, rce (tag impact: VERY HIGH)

Recommended actions:

  • Fix privilege escalation urgently.
  • Enforce least-privilege and strengthen EDR detection.
  • Patch/upgrade immediately (remote code execution).
  • Reduce exposure (WAF/segmentation), minimize attack surface.

Recommended tools

Tags