Vulnerability record · CVE-2014-3931 · published 31 March 2017
CVE-2014-3931: MRLG fastping.c buffer overflow allows remote memory corruption
MMulti Router Looking Glass Project · Multi Router Looking Glass
MRLG (Multi-Router Looking Glass) before 5.5.0 contains a memory buffer overflow in fastping.c that permits an arbitrary memory write and memory corruption. The flaw is remotely reachable without authentication and carries a CVSS 3.1 base score of 9.8, so it is a serious pre-auth risk for any exposed instance.
Description
fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 pre-auth network reachable memory corruption combined with CISA KEV listing and high EPSS percentile makes this a critical priority.
What it is
MRLG (Multi-Router Looking Glass) before 5.5.0 contains a memory buffer overflow in fastping.c that permits an arbitrary memory write and memory corruption. The flaw is remotely reachable without authentication and carries a CVSS 3.1 base score of 9.8, so it is a serious pre-auth risk for any exposed instance.
Impact
An attacker can corrupt memory and perform an arbitrary write, which can lead to code execution or a denial of service on the affected service.
Attack surface
The CVSS vector AV:N/AC:L/PR:N/UI:N indicates the flaw is reachable over the network with no authentication and no user interaction. The description does not specify the exact protocol or input path beyond fastping.c.
Exploitation
CVE-2014-3931 is listed in CISA KEV with a due date of 2025-07-28, and EPSS shows a 30-day probability of 0.28978 (98th percentile); a HackerOne report is tagged as an exploit reference. No ransomware campaign use is documented.
What to do
- Upgrade MRLG to version 5.5.0 or later, which is the first version not affected per the description.
- If upgrading is not possible, remove or restrict network access to the MRLG service and follow CISA's required action to discontinue use if no mitigation is available.
- Place the service behind authentication and network access controls so it is not reachable by unauthenticated remote clients.
- Monitor vendor and CISA guidance for any backported fixes or interim mitigations.
Detection
- Inspect MRLG/fastping service logs for crashes, abnormal restarts or malformed ICMP-related input.
- Monitor network traffic to the MRLG service for unexpected or oversized requests from untrusted sources.
- Use host-based detection for memory corruption indicators such as unexpected process termination or suspicious child processes spawned by the MRLG service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2014-3931 to the Known Exploited Vulnerabilities catalog on 7 July 2025 as "Multi-Router Looking Glass (MRLG) Buffer Overflow Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 28 July 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://mrlg.op-sec.us/ | Third Party Advisory |
| http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt | Third Party Advisory |
| https://hackerone.com/reports/16330 | ExploitThird Party Advisory |
| http://mrlg.op-sec.us/ | Third Party Advisory |
| http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt | Third Party Advisory |
| https://hackerone.com/reports/16330 | ExploitThird Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3931 | US Government Resource |
Track CVE-2014-3931 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-3931), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
