{"uuid": "1f47e824-a9a1-4c52-a030-8c1359d3899c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-6271", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"hdm \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits the Shellshock vulnerability, a flaw in how the Bash shell\\n          handles external environment variables. This module targets the 'ping.sh' CGI\\n          script, accessible through the Boa web server on Advantech switches. This module\\n          was tested against firmware version 1322_D1.98.\", \"disclosure_date\": \"2015-12-01\", \"fullname\": \"exploit/linux/http/advantech_switch_bash_env_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"Advantech Switch Bash Environment Variable Code Injection (Shellshock)\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Shellshock\"], \"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb\", \"platform\": \"Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/advantech_switch_bash_env_exec\", \"references\": [\"CVE-2014-6271\", \"CWE-94\", \"OSVDB-112004\", \"EDB-34765\", \"URL-https://www.rapid7.com/blog/post/2015/12/01/r7-2015-25-advantech-eki-multiple-known-vulnerabilities\", \"URL-https://access.redhat.com/articles/1200223\", \"URL-https://seclists.org/oss-sec/2014/q3/649\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Targeting\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:20.432460Z"}