SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2014-6271

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

KEVEXPLOIT ×21 ✓CRITICAL 9.8EPSS 100.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 28 July 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
100.00% probability · 100th percentile
Public exploits
21 in Exploit-DB · verified · first 25 September 2014
CISA KEV
Listed 28 January 2022 · due 28 July 2022
Weakness
CWE-78
Affected
gnu/bash · arista/eos · oracle/linux · qnap/qts · mageia/mageia · redhat/gluster storage server for on-premise · redhat/virtualization · redhat/enterprise linux · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux for ibm z systems · redhat/enterprise linux for power big endian · redhat/enterprise linux for power big endian eus · redhat/enterprise linux for scientific computing · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server from rhui · redhat/enterprise linux server tus · redhat/enterprise linux workstation · suse/studio onsite · +40 more
Source
security@debian.org
EPSS trend
0%50%100%30 October 2026: 100.00%30 October 202630 October 2026

EPSS 100.0% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2014-6271

Public exploits (21)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-IDTitleTypePublishedVerified
EDB-42938source ↗Qmail SMTP - Bash Environment Variable Injection (Metasploit)linux · Metasploitremote2 October 2017yes
EDB-40938source ↗RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injectionlinux · Hacker Fantasticlocal18 December 2016yes
EDB-40619source ↗TrendMicro InterScan Web Security Virtual Appliance - 'Shellshock' Remote Command Injectionhardware · Hacker Fantasticremote21 October 2016no
EDB-39918source ↗IPFire - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)cgi · Metasploitremote10 June 2016yes
EDB-38849source ↗Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)cgi · Metasploitremote2 December 2015yes
EDB-37816source ↗Cisco Unified Communications Manager - Multiple Vulnerabilitiesmultiple · Bernhard Muellerwebapps18 August 2015no
EDB-36609source ↗Kemp Load Master 7.1.16 - Multiple Vulnerabilitiesmultiple · Roberto Suggi Liveraniwebapps2 April 2015no
EDB-36504source ↗QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)hardware · Patrick Pellegrinoremote26 March 2015no
EDB-36503source ↗QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)hardware · Patrick Pellegrinoremote26 March 2015no
EDB-35146source ↗PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injectionphp · Ryan King (Starfall)webapps3 November 2014no
EDB-35115source ↗CUPS Filter - Bash Environment Variable Code Injection (Metasploit)linux · Metasploitremote29 October 2014yes
EDB-34900source ↗Apache mod_cgi - 'Shellshock' Remote Command Injectionlinux · Federico Galatoloremote6 October 2014yes
EDB-34896source ↗Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injectionlinux · Phil Blankremote6 October 2014yes
EDB-34895source ↗Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)cgi · Fady Mohammed Osmanwebapps6 October 2014yes
EDB-34879source ↗OpenVPN 2.2.29 - 'Shellshock' Remote Command Injectionlinux · hobbily pluntremote4 October 2014no
EDB-34862source ↗Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)linux · Metasploitremote2 October 2014yes
EDB-34860source ↗GNU bash 4.3.11 - Environment Variable dhclientlinux · @0x00stringremote2 October 2014no
EDB-34839source ↗IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injectioncgi · Claudio Vivianiwebapps1 October 2014yes
EDB-34777source ↗GNU Bash - Environment Variable Command Injection (Metasploit)cgi · Shaun Colleyremote25 September 2014yes
EDB-34766source ↗Bash - 'Shellshock' Environment Variables Command Injectionlinux · Prakhar Prasad & Subho Halderremote25 September 2014yes
EDB-34765source ↗GNU Bash - 'Shellshock' Environment Variable Command Injectionlinux · Stephane Chazelasremote25 September 2014yes

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.