CVE-2014-0644: EMC Cloud Tiering Appliance XXE allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote arbitrary file read with a high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

EMC Cloud Tiering Appliance (CTA) 10 through SP1 processes XML in an api/login request without disabling external entity declarations, allowing an XML External Entity (XXE) attack. A remote attacker can supply an entity reference to make the appliance return the contents of arbitrary files, as demonstrated against /etc/shadow. This exposes sensitive system files and credentials on the appliance.

Impact

An unauthenticated remote attacker gains read access to arbitrary files on the appliance, including /etc/shadow, enabling credential theft and further compromise. The flaw affects confidentiality only; there is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network through the api/login endpoint, which parses attacker-supplied XML. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no reference tags indicate a public exploit, though EPSS is high at 0.53342 (99th percentile), suggesting elevated likelihood of exploitation activity. The description includes a demonstrated file-read technique, but no confirmed in-the-wild exploitation is recorded here.

What to do

• Apply the vendor patch or upgrade CTA beyond the affected 10 through SP1 releases; confirm the fixed version with EMC support since the record does not name one.
• Disable external entity and DTD processing in the XML parser handling api/login requests.
• Restrict network access to the CTA management/api interface to trusted hosts only.
• Rotate credentials for accounts whose hashes or secrets reside on the appliance, especially if /etc/shadow may have been read.

Detection

• Inspect api/login request bodies for DOCTYPE declarations or SYSTEM/PUBLIC entity references.
• Monitor for outbound or file-read patterns returning contents of /etc/shadow or other sensitive paths in API responses.
• Alert on anomalous access to the CTA api/login endpoint from unexpected source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.