CVE-2014-3789: Cogent DataHub GetPermissions.asp command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution in an industrial data broker with a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.

What it is

GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands through unspecified vectors, classified as CWE-94 code injection. The flaw matters because it is network-reachable without authentication and affects an industrial data broker, giving attackers a path to run code on a system that often bridges OT and IT networks.

Impact

An attacker can execute arbitrary commands on the DataHub host, gaining the privileges of the web service process. That can lead to full compromise of the data broker and any connected industrial data sources or downstream systems.

Attack surface

Reached over the network via the GetPermissions.asp endpoint, per the AV:N vector. The CVSS 2.0 vector shows Au:N, so no authentication is required, and no user interaction is indicated.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high at 0.63366 (99.17th percentile), and references include a Zero Day Initiative advisory, but no public exploit is confirmed in the record.

What to do

• Upgrade Cogent DataHub to version 7.3.5 or later per the vendor release notes.
• Restrict network access to the DataHub web interface, especially GetPermissions.asp, to trusted management hosts only.
• Place the DataHub host behind a firewall or segmented zone so it is not reachable from untrusted networks.
• Review ICS-CERT advisory ICSA-15-246-01 for additional vendor and mitigation guidance.
• Monitor the DataHub service account and limit its privileges to reduce the impact of command execution.

Detection

• Inspect web server and DataHub logs for requests to GetPermissions.asp, particularly with unusual parameters or from unexpected source IPs.
• Alert on child processes spawned by the DataHub web service or IIS worker process, which may indicate command execution.
• Monitor for outbound connections or command-shell activity originating from the DataHub host.
• Baseline normal access to the DataHub web interface and alert on deviations in request patterns or source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.