Vulnerability record · CVE-2014-5073 · published 29 August 2014
CVE-2014-5073: VMTurbo Operations Manager vmtadmin.cgi command injection
VVmturbo · Operations Manager
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 passes the fileDate parameter of a DOWN call to a shell without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject and execute arbitrary commands on the server. The flaw is a classic OS command injection in a web-exposed management component.
Description
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote command execution with public exploit code and a very high EPSS score makes this an urgent patch-or-isolate case.
What it is
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 passes the fileDate parameter of a DOWN call to a shell without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject and execute arbitrary commands on the server. The flaw is a classic OS command injection in a web-exposed management component.
Impact
An attacker gains remote command execution with the privileges of the vmtadmin.cgi process, allowing full compromise of the Operations Manager host and any data or credentials it holds. No privilege escalation step is required beyond reaching the endpoint.
Attack surface
Reachable over the network through the vmtadmin.cgi web interface via a crafted DOWN request containing shell metacharacters in fileDate. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are needed.
Exploitation
Public exploit code exists (Exploit-DB 34335, Packet Storm, SecurityFocus BID 69225), and EPSS is 0.7345 (99.4th percentile), indicating high predicted exploitation activity. It is not listed in CISA KEV.
What to do
- Upgrade VMTurbo Operations Manager to 4.6 build 28657 or later, which fixes the flaw.
- If patching is not immediately possible, restrict network access to vmtadmin.cgi to trusted management hosts only.
- Place the Operations Manager web interface behind an authenticated reverse proxy or VPN.
- Monitor and block requests to vmtadmin.cgi containing shell metacharacters in the fileDate parameter.
- Rotate any credentials or secrets stored on or accessible from the Operations Manager host if compromise is suspected.
Detection
- Inspect web server and proxy logs for DOWN requests to vmtadmin.cgi with shell metacharacters (;, |, $(), backticks) in the fileDate parameter.
- Alert on unexpected child processes spawned by the vmtadmin.cgi process or its web server parent.
- Monitor for outbound connections from the Operations Manager host to unfamiliar addresses following vmtadmin.cgi requests.
- Review file integrity and command history on the Operations Manager host for signs of injected command execution.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-5073 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-5073), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
