CVE-2014-3804: AlienVault OSSIM av-centerd SOAP service command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS base score of 10.0 and public exploit code makes this an urgent risk for any unpatched OSSIM deployment.

What it is

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 fails to properly validate input in several request types, allowing remote command injection. An unauthenticated attacker can execute arbitrary commands on the OSSIM server, which is a security management platform and therefore a high-value target.

Impact

An attacker gains remote code execution with the privileges of the av-centerd service, leading to full compromise of the OSSIM host and potentially the monitored environment. This can result in data theft, configuration tampering, or use of the host as a pivot point.

Attack surface

The flaw is reachable over the network via the av-centerd SOAP service, as indicated by the CVSS vector AV:N/AC:L/Au:N. No authentication or user interaction is required.

Exploitation

Exploit code is publicly available (Exploit-DB 42708), and EPSS indicates a high probability of exploitation activity (0.72376, 99.41st percentile). The CVE is not listed in CISA KEV.

What to do

• Upgrade AlienVault OSSIM to version 4.7.0 or later.
• Restrict network access to the av-centerd SOAP service to trusted management hosts only.
• If patching is not immediately possible, disable or firewall the av-centerd service until the upgrade can be applied.
• Monitor for and investigate any unexpected outbound connections or process executions on OSSIM servers.

Detection

• Inspect SOAP requests to av-centerd for suspicious parameters such as update_system_info_debian_package, ossec_task, set_ossim_setup, or sync_rserver containing shell metacharacters.
• Monitor process creation on OSSIM hosts for unexpected child processes spawned by the av-centerd service.
• Review network logs for connections to the av-centerd SOAP port from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.