CVE-2014-3932: SQL injection vulnerability in the device registration component in wsf/webservice.php in CoSoSys Endpoint...

Security readout for executives and security teams

CVE-2014-3932 is a SQL injection flaw in CoSoSys Endpoint Protector 4 device registration. A remote attacker could send crafted input to the affected web service and cause unauthorized database commands. For executives, the concern is compromise of an endpoint management platform, not only one endpoint. Exposure is most likely where Endpoint Protector 4 4.3.0.4 or 4.4.0.2 remains deployed and the web service endpoint is reachable by untrusted networks. The bundle does not confirm broader affected versions, CPEs, or current internet exposure. Prioritize remediation if Endpoint Protector 4 is still in use, especially if reachable beyond trusted administrative networks. This vulnerability affects a security management product, so compromise could undermine endpoint governance and sensitive device-control data. Mitigation focus: Inventory CoSoSys Endpoint Protector deployments and identify versions 4.3.0.4 and 4.4.0.2.; Check CoSoSys or advisory guidance for fixed versions or supported remediation.; Restrict access to Endpoint Protector web services to trusted networks only..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.