Skip to content
Fencer Intel
critical 9.8

CVE-2014-6271 kev in the critical feed json

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote atta…

published 12y ago modified 4mo ago also EUVD-2014-6157

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2022-01-28
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
31
Metasploit and Exploit-DB, plus a Nuclei check

Summary

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • ibm software_defined_network_for_virtual_environments 1.2.1
  • checkpoint security_gateway r77.30
  • arista eos 4.9.12, 4.10.9, 4.11.11, 4.12.9, 4.13.9, 4.14.4f
  • qnap qts 4.1.1
  • ibm storwize_v7000_firmware 1.4.3.5, 1.5.0.4, 7.2.0.9, 7.3.0.7
  • ibm storwize_v5000_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm storwize_v3700_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm storwize_v3500_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm flex_system_v7000_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm san_volume_controller_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm stn6500_firmware 3.8.0.07, 3.9.1.08, 4.1.2.06
  • ibm stn6800_firmware 3.8.0.07, 3.9.1.08, 4.1.2.06
  • ibm stn7800_firmware 3.8.0.07, 3.9.1.08, 4.1.2.06
  • citrix netscaler_sdx_firmware 9.3.67.5r1, 10.1.129.11r1, 10.5.52.11r1
  • apple mac_os_x 10.10.0
  • bash Debian 14, Debian 13, Debian 12 4.3-9.1

debian advisories DEBIAN-CVE-2014-6271

  • bash Ubuntu 14.04 LTS 4.3-7ubuntu1.1

ubuntu advisories UBUNTU-CVE-2014-6271

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bash RHEL 5 3.2-33.el5.1
  • bash RHEL 6 4.1.2-15.el6_5.1
  • bash RHEL 7 4.2.45-5.el7_0.2
  • rhev-hypervisor6 rhev manager 3 6.5-20140930.1.el6ev
  • bash RHEL 5 SJIS 3.2-33.el5_11.1.sjis.1
  • bash RHEL 6 SJIS 4.1.2-15.el6_5.1.sjis.1
  • bash RHEL 4 ELS 3.0-27.el4.2
  • bash RHEL 5.6 MISSION_CRITICAL 3.2-24.el5_6.1

red hat advisories RHSA-2014:1293RHSA-2014:1354RHSA-2014:1295RHSA-2014:1294

  • bash openSUSE Tumbleweed 7.0-92.1

opensuse advisories openSUSE-SU-2024:10106-1

Is CVE-2014-6271 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-6271 updated cvss 7.5

bash: specially-crafted environment variables can be used to inject shell commands

  • Red Hat Enterprise Linux (v. 5 server) bash 3.2-33.el5.1
    fixed: vendor fix RHSA-2014:1293
  • Red Hat Enterprise Linux AS (v. 4 ELS) bash 3.0-27.el4.2
    fixed: vendor fix RHSA-2014:1294
  • Red Hat Enterprise Linux Client (v. 7) bash 4.2.45-5.el7_0.2 Red Hat Enterprise Linux Client Optional (v. 7) bash-doc 4.2.45-5.el7_0.2, bash-debuginfo 4.2.45-5.el7_0.2
    fixed: vendor fix RHSA-2014:1293
  • Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) bash 4.1.2-15.el6_4.1
    fixed: vendor fix RHSA-2014:1294
  • Red Hat Enterprise Linux ComputeNode (v. 7) bash 4.2.45-5.el7_0.2 Red Hat Enterprise Linux ComputeNode Optional (v. 7) bash-doc 4.2.45-5.el7_0.2, bash-debuginfo 4.2.45-5.el7_0.2 Red Hat Enterprise Linux Desktop (v. 5 client) bash 3.2-33.el5.1 Red Hat Enterprise Linux Desktop (v. 6) bash 4.1.2-15.el6_5.1 Red Hat Enterprise Linux Desktop Optional (v. 6) bash 4.1.2-15.el6_5.1
    fixed: vendor fix RHSA-2014:1293
  • Red Hat Enterprise Linux ES (v. 4 ELS) bash 3.0-27.el4.2 Red Hat Enterprise Linux EUS (v. 5.9 server) bash 3.2-32.el5_9.2
    fixed: vendor fix RHSA-2014:1294
  • Red Hat Enterprise Linux HPC Node (v. 6) bash 4.1.2-15.el6_5.1
    fixed: vendor fix RHSA-2014:1293
  • Red Hat Enterprise Linux HPC Node EUS (v. 6.4) bash 4.1.2-15.el6_4.1
    fixed: vendor fix RHSA-2014:1294
show 9 more
  • Red Hat Enterprise Linux HPC Node Optional (v. 6) bash 4.1.2-15.el6_5.1
    fixed: vendor fix RHSA-2014:1293
  • Red Hat Enterprise Linux Long Life (v. 5.6 server) bash 3.2-24.el5_6.1
    fixed: vendor fix RHSA-2014:1294
  • Red Hat Enterprise Linux Server (v. 6) bash 4.1.2-15.el6_5.1 Red Hat Enterprise Linux Server (v. 7) bash 4.2.45-5.el7_0.2
    fixed: vendor fix RHSA-2014:1293
  • Red Hat Enterprise Linux Server AUS (v. 6.2) bash 4.1.2-9.el6_2.1 Red Hat Enterprise Linux Server EUS (v. 6.4) bash 4.1.2-15.el6_4.1
    fixed: vendor fix RHSA-2014:1294
  • Red Hat Enterprise Linux Server Optional (v. 6) bash 4.1.2-15.el6_5.1 Red Hat Enterprise Linux Server Optional (v. 7) bash-doc 4.2.45-5.el7_0.2, bash-debuginfo 4.2.45-5.el7_0.2
    fixed: vendor fix RHSA-2014:1293
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.2) bash 4.1.2-9.el6_2.1 Red Hat Enterprise Linux Server Optional EUS (v. 6.4) bash 4.1.2-15.el6_4.1
    fixed: vendor fix RHSA-2014:1294
  • Red Hat Enterprise Linux Workstation (v. 6) bash 4.1.2-15.el6_5.1 Red Hat Enterprise Linux Workstation (v. 7) bash 4.2.45-5.el7_0.2 Red Hat Enterprise Linux Workstation Optional (v. 6) bash 4.1.2-15.el6_5.1 Red Hat Enterprise Linux Workstation Optional (v. 7) bash-doc 4.2.45-5.el7_0.2, bash-debuginfo 4.2.45-5.el7_0.2
    fixed: vendor fix RHSA-2014:1293
  • Red Hat RHEV-M 3.4 rhev-hypervisor6 6.5-20140930.1.el6ev
    fixed: vendor fix RHSA-2014:1354
  • Red Hat S-JIS for Red Hat Enteprise Linux 5 Server bash 3.2-33.el5_11.1.sjis.1 Red Hat S-JIS for Red Hat Enteprise Linux 6 Server bash 4.1.2-15.el6_5.1.sjis.1
    fixed: vendor fix RHSA-2014:1295

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-15-344-01B updated cvss 10.0

Advantech EKI Vulnerabilities (Update B)

  • Advantech EKI-132x platform devices
    affected: mitigation “Update to the latest version. (http://support.advantech.com.tw/Support/SearchResult.aspx?keyword=EKI-132*&searchtabs=Firmware)”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-14-269-01A updated cvss 10.0

Bash Command Injection Vulnerability

  • ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens ABB Tropos 3000, 4000, 6000, & 7000 series routers ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens ABB Ventyx NM EMS/SCADA on RHEL Ventyx ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens Meinberg LANTIME 4.x, 5.x, 6.x ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens Moxa Linux-based computers ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens Red Lion RAM 9000, RAM 6000, SN 6000 and M, A and R Series ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens Red Lion Sixnet BT-5000 and 6000 Series
    +3 more products
    ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens Siemens APE Linux with ELAN installed V1.0 ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens Siemens ROX 2 <=V2.5.0 ABB ; Cisco ; Digi ; eWON ; Meinberg ; Moxa ; Red Lion; Siemens Siemens ROX 1 <=V1.16.0
    affected: mitigation “Patches have been released to fix this vulnerability by major Linux vendors for affected versions” cve.org

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/scanner/http/apache_mod_cgi_bash_env)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4y ago
Patch by
2022-07-28 (4y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
GNU, Bourne-Again Shell (Bash)
CISA name
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1133 External Remote Services exploitation
  • T1190 Exploit Public-Facing Application exploitation
  • T1059.004 Unix Shell primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
last yr.

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/linux/http/advantech_switch_bash_env_exec Advantech Switch Bash Environment Variable Code Injection (Shellshock) metasploit exploit, excellent rank, 2015-12-01
  • Metasploit exploit/linux/http/ipfire_bashbug_exec IPFire Bash Environment Variable Injection (Shellshock) metasploit exploit, excellent rank, 2014-09-29
  • Metasploit auxiliary/scanner/http/apache_mod_cgi_bash_env Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner metasploit auxiliary, normal rank, 2014-09-24
  • Metasploit auxiliary/server/dhclient_bash_env DHCP Client Bash Environment Variable Code Injection (Shellshock) metasploit auxiliary, normal rank, 2014-09-24
  • Metasploit exploit/multi/ftp/pureftpd_bash_env_exec Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock) metasploit exploit, excellent rank, 2014-09-24
  • Metasploit exploit/multi/http/apache_mod_cgi_bash_env_exec Apache mod_cgi Bash Environment Variable Code Injection (Shellshock) metasploit exploit, excellent rank, 2014-09-24
  • Metasploit exploit/multi/http/cups_bash_env_exec CUPS Filter Bash Environment Variable Code Injection (Shellshock) metasploit exploit, excellent rank, 2014-09-24
  • Metasploit exploit/osx/local/vmware_bash_function_root OS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection (Shellshock) metasploit exploit, normal rank, 2014-09-24
  • Metasploit exploit/unix/dhcp/bash_environment Dhclient Bash Environment Variable Injection (Shellshock) metasploit exploit, excellent rank, 2014-09-24
  • Metasploit exploit/unix/smtp/qmail_bash_env_exec Qmail SMTP Bash Environment Variable Injection (Shellshock) metasploit exploit, normal rank, 2014-09-24
  • EDB-42938 Qmail SMTP - Bash Environment Variable Injection (Metasploit) remote, 2017-10-02
  • EDB-40938 RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection local, 2016-12-18
  • EDB-40619 TrendMicro InterScan Web Security Virtual Appliance - 'Shellshock' Remote Command Injection remote, 2016-10-21
  • EDB-39918 IPFire - 'Shellshock' Bash Environment Variable Command Injection (Metasploit) remote, 2016-06-10
  • EDB-38849 Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit) remote, 2015-12-02
  • EDB-37816 Cisco Unified Communications Manager - Multiple Vulnerabilities webapps, 2015-08-18
  • EDB-36609 Kemp Load Master 7.1.16 - Multiple Vulnerabilities webapps, 2015-04-02
  • EDB-36504 QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit) remote, 2015-03-26
  • EDB-36503 QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit) remote, 2015-03-26
  • EDB-35146 PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection webapps, 2014-11-03
  • EDB-35115 CUPS Filter - Bash Environment Variable Code Injection (Metasploit) remote, 2014-10-29
  • EDB-34900 Apache mod_cgi - 'Shellshock' Remote Command Injection remote, 2014-10-06
  • EDB-34896 Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection remote, 2014-10-06
  • EDB-34895 Bash CGI - 'Shellshock' Remote Command Injection (Metasploit) webapps, 2014-10-06
  • EDB-34879 OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection remote, 2014-10-04
  • EDB-34862 Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit) remote, 2014-10-02
  • EDB-34860 GNU bash 4.3.11 - Environment Variable dhclient remote, 2014-10-02
  • EDB-34839 IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection webapps, 2014-10-01
  • EDB-34777 GNU Bash - Environment Variable Command Injection (Metasploit) remote, 2014-09-25
  • EDB-34766 Bash - 'Shellshock' Environment Variables Command Injection remote, 2014-09-25
  • EDB-34765 GNU Bash - 'Shellshock' Environment Variable Command Injection remote, 2014-09-25
  • Nuclei template ShellShock - Remote Code Execution nuclei detection template
  • lcamtuf.blogspot.com http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/128573/Apache-mod_cgi-Remote-Command-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/137376/IPFire-Bash-Environment-Variable-Injection-Shellshock.html referenced PoC, tagged "exploit" by a source, unverified
  • access.redhat.com https://access.redhat.com/articles/1200223 referenced PoC, tagged "exploit" by a source, unverified
  • access.redhat.com https://access.redhat.com/node/1200223 referenced PoC, tagged "exploit" by a source, unverified
  • securityblog.redhat.com https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.