← Back

CVE-2014-2959

nvd nist
Published: Jun 2, 2014Modified: May 6, 2026

JSON object

Loading...
9.0
Vector
AV:N/AC:L/Au:N/C:C/I:P/A:P
Exploitability: 10.0 / Impact: 8.5
Source: NVD

Description

logViewer.htm on the Dell ML6000 tape backup system with firmware before i8.2.0.2 (641G.GS103) and the Quantum Scalar i500 tape backup system with firmware before i8.2.2.1 (646G.GS002) allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter.

Affected (7)

Dell
2 products
Powervault Ml6000 Firmware
Powervault Ml6000
Quantum
2 products
Scalar I500 Firmware
Scalar I500
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Powervault Ml6000 Firmware
Up to i8.2.0.1_\(641g.gs003\)
Dell
Powervault Ml6000
Version 32u
Powervault Ml6000
Version 41u
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Scalar I500 Firmware
Up to i8.2.2.1_\(646g.gs002\)
Quantum
Scalar I500
Version 14u
Scalar I500
Version 23u
Scalar I500
Version 5u

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

Source: cret@cert.org
Source: cret@cert.org
US Government Resource
Source: cret@cert.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
US Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.