← Vulnerability feed

Vulnerability record · CVE-2014-3440 · published 21 January 2015

CVE-2014-3440: Broadcom symantec critical system protection improper input validation vulnerability

Broadcom · Symantec Critical System Protection

The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary commands by leveraging client-system access to upload a log file.

9.0 CVSS 2.0 High EPSS 3.3% · top 11.9% CWE-20 · Improper input validation
9.0CVSS 2.0 base score
3.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary commands by leveraging client-system access to upload a log file.

AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://seclists.org/fulldisclosure/2015/May/39
http://www.securityfocus.com/bid/72091
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Vendor Advisory
http://seclists.org/fulldisclosure/2015/May/39
http://www.securityfocus.com/bid/72091
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Vendor Advisory

Track CVE-2014-3440 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-18374Broadcom symantec critical system protection improper authentication vulnerabilitySymantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a …EPSS 1.7%8.8CVE-2015-8157Broadcom symantec critical system protection sql injection vulnerabilitySQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedd…EPSS 1.5%8.0CVE-2015-8798Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 2.4%7.8CVE-2020-5832Symantec data center security vulnerabilitySymantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a…EPSS 0.38%7.6CVE-2015-8799Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 5.3%7.6CVE-2013-5016Broadcom symantec critical system protection permissions and access controls vulnerabilitySymantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to b…EPSS 2.4%7.3CVE-2015-8800Broadcom symantec critical system protection injection vulnerabilitySymantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers …EPSS 1.2%7.2CVE-2014-9226Broadcom symantec critical system protection permissions and access controls vulnerabilityThe management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2014-3440), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.