Every CVESearch/Get API key

CVE-2014-9605

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote...

9.4 HighPublic exploit

CVE-2014-9605 is a high vulnerability (CVSS 9.4) in Netsweeper, published September 4, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.94%, the 90th percentile. No source names a fixed version.

What does this mean?
Severity
9.4 HighCVSS 2.0, NVD
Exploit chance
3.94%EPSS, 90th percentile
Exploitation
None known1 public exploit
Fixed in
No fix listedNo source names one

Description

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.

Exploit likelihood

3.94%Up 2.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBNetsweeper 4.0.8 - SQL Injection / Authentication Bypass2015-08-21

What each source reports

NVD Score used9.4

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.

Record
CVE-2014-9605
CVSS 2.0
9.4 HighAV:N/AC:L/Au:N/C:C/I:N/A:C
Weakness
CWE-287
Updated
2026-11-02
CVE ListNo score

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.

Record
CVE-2014-9605
Updated
2026-11-02
EUVDEUVD-2014-9418No score

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.

Record
EUVD-2014-9418
Updated
2026-11-03
GitHub AdvisoriesGHSA-5w8q-6cmq-6gcpNo score

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote...

WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webupgrade/webupgrade.php. NOTE: this was originally reported as an SQL injection vulnerability, but this may be inaccurate.

Record
GHSA-5w8q-6cmq-6gcp
Weakness
CWE-287
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open