CVE-2014-7285

The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote...

6.5 MediumPublic exploit

The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Exploit likelihood

50.3%Down 21.6 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2014-7285
CVSS 2.0: 6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-77
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-7285
Updated: 2026-11-02

EUVDEUVD-2014-7156 No score

Record: EUVD-2014-7156
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jrrc-8w3m-x99x No score

The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote...

Record: GHSA-jrrc-8w3m-x99x
Weakness: CWE-77
Updated: 2026-11-02

Affected products

symantec web gateway

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Symantec Web Gateway 5 - 'restore.php' (Authenticated) Command Injection (Metasploit)	2015-03-04
Metasploit	Symantec Web Gateway 5 restore.php Post Authentication Command Injection	2014-12-16

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7285 is a medium vulnerability (CVSS 6.5) in Symantec Web Gateway, published December 17, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 50.3%, the 98th percentile. No source names a fixed version.