CVE-2014-6271
RCE in Ibm Qradar Security Information And Event Manager 7.1.0 … 7.2.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2014-6271 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ibm Qradar Security Information And Event Manager. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
GNU Bash through 4.3 contains a flaw that causes it to process trailing strings after function definitions within environment variable values. This affects the Bash shell itself and surfaces in any context where Bash is invoked across a privilege boundary, including OpenSSH's ForceCommand feature, Apache HTTP Server mod_cgi and mod_cgid modules, certain DHCP client scripts, and similar configurations.
Remote attackers can supply a crafted environment variable to execute arbitrary code without authentication or user interaction. Successful exploitation grants complete control over the affected process, enabling full read, write, and execute access as indicated by the CVSS 9.8 rating and CWE-78 classification.
The initial remediation for this issue proved incomplete, resulting in the assignment of CVE-2014-7169 for the residual vulnerability. Vendor advisories such as those from Mageia, Juniper, JVN, and related sources document the necessary updates and configuration changes.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2014-6157
Vulnerability Data
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the…
more
mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
- CWE(s)
- KEV Date Added
- 28 January 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5V1.2.8V15.2.5
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.