CVE-2014-7994: Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote attackers to execute arbit...

Security readout for executives and security teams

This CVE describes a command execution flaw in older Cisco Meraki MS, MR, and MX firmware. An attacker on the local network could run commands if they knew both a shared cross-device secret and a per-device secret. The public bundle does not provide CVSS scoring, exact fixed versions, or evidence of active exploitation. Exposure is likely limited to organizations still running very old Meraki MS, MR, or MX firmware from before 2014-09-24. Because the attack path is local-network HTTP and requires secrets, internet-wide exposure is not established by the supplied sources. Treat as high priority only if legacy Meraki infrastructure remains in service. The vulnerability affects network control points, but the public record is old, lacks CVSS, and does not show active exploitation in the supplied evidence. Mitigation focus: Check Cisco and Meraki firmware security guidance for defect ID 00301991.; Confirm all MS, MR, and MX devices run firmware dated 2014-09-24 or later.; Prioritize replacement or upgrade of devices unable to run supported firmware..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.