Security readout for executives and security teams
Plain-English summary
CVE-2014-125118 is a critical command injection issue in MicroWorld eScan Web Management Console 5.5-2. A user with a valid username can abuse the login password field to run operating-system commands. The source bundle says remote code execution and possible root escalation are possible, making exposed legacy consoles urgent to find and contain.
Executive priority
Prioritize discovery and containment now. The issue enables remote code execution in a security management product and may lead to root access. Absence from KEV lowers evidence of active exploitation, but public exploit references and critical impact make unmanaged exposure unacceptable.
Technical view
The vulnerable login.php flow fails to sanitize the pass parameter. The provided record describes low-complexity network exploitation with low privileges and no user interaction. Public exploit references exist, including Exploit-DB and a Metasploit module, but the bundle does not cite vendor patch details or confirmed in-the-wild exploitation.
Likely exposure
Exposure is limited to environments still running eScan Web Management Console version 5.5-2. Risk is highest where the web management console is reachable from untrusted networks or shared administrative networks. The bundle does not establish broader affected versions, CPEs, or default internet exposure.
Exploitation context
The CVE is not marked KEV in the provided data, so active exploitation is not established here. However, public exploit material is cited, meaning defenders should treat the issue as reproducible by capable attackers with console access and a valid username.
Researcher notes
Evidence supports command injection through the pass parameter during login processing and possible escalation via runasroot with mwconf-level privileges. The record also lists CWE-306, but the description requires a valid username; do not assume unauthenticated exploitation without additional source evidence.
Mitigation direction
- Identify any eScan Web Management Console 5.5-2 deployments.
- Restrict console access to trusted administrative networks only.
- Check MicroWorld or product support guidance for patches or replacement paths.
- Disable or retire affected legacy consoles where operationally possible.
- Review privileged utility access around mwconf and runasroot.
Validation and detection
- Confirm product name and version on all eScan management hosts.
- Verify whether login.php is reachable from untrusted networks.
- Review authentication logs for unusual login attempts against the console.
- Check for unexpected mwconf-level or root-level activity after console logins.
- Track remediation status for every identified 5.5-2 instance.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2014-125118 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exploit-db.com/exploits/32869CVE reference · exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/antivirus/escan_password_exec.rbCVE reference · exploit
- https://www.vulncheck.com/advisories/escan-web-management-console-command-injectionCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.