CVE-2014-6278

unknown KEV

Published 2025-10-02 · Modified 2025-10-02

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

2.5

Description

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

CISA KEV

Vendor: GNU
Product: GNU Bash
Due date: 2025-10-23

Predictions

Exploit likelihood

99%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

{Vendor advisory: cisa-kev — This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ; https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ; https://nvd.nist.gov/vuln/detail/CVE-2014-6278}

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-36933 remote linux verified

fdiskyou · 2014-09-29

dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)

Source code queued for fetch — refresh in a moment.

EDB-39887 webapps cgi

lastc0de · 2016-06-06

Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)

Source code queued for fetch — refresh in a moment.

EDB-34860 remote linux

@0x00string · 2014-10-02

GNU bash 4.3.11 - Environment Variable dhclient

Source code queued for fetch — refresh in a moment.

EDB-39568 remote hardware

thatchriseckert · 2016-03-16

Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)

Source code queued for fetch — refresh in a moment.

EDB-34900 remote linux verified

Federico Galatolo · 2014-10-06

Apache mod_cgi - 'Shellshock' Remote Command Injection

Source code queued for fetch — refresh in a moment.

Metasploit modules

auxiliary_scanner/http/apache_mod_cgi_bash_env rank 300

Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner

Source code queued for fetch — refresh in a moment.

exploit_multi/http/cups_bash_env_exec rank 600

CUPS Filter Bash Environment Variable Code Injection (Shellshock)

Source code queued for fetch — refresh in a moment.

exploit_multi/http/apache_mod_cgi_bash_env_exec rank 600

Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)

Source code queued for fetch — refresh in a moment.

OS impact

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`4.3-9.2`
sid	Fixed	`4.3-9.2`
forky	Fixed	`4.3-9.2`
bullseye	Fixed	`4.3-9.2`
bookworm	Fixed	`4.3-9.2`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.