CVE-2014-6287: Rejetto HTTP File Server null byte code injection in findMacroMarker

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, active inclusion in CISA KEV, near-maximum EPSS, and public exploit code make this a high-likelihood, high-impact remote code execution flaw.

What it is

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS) 2.3x before 2.3c mishandles a %00 sequence in a search action, allowing code injection. A remote, unauthenticated attacker can execute arbitrary programs on the host, making this a full compromise of the service and its underlying system.

Impact

An attacker gains remote code execution with the privileges of the HFS process, allowing arbitrary program execution, data theft, or use of the host as a foothold.

Attack surface

Reached over the network via the HFS search action; the CVSS vector shows no privileges required and no user interaction, so it is exploitable directly against an exposed server.

Exploitation

CVE-2014-6287 is listed in CISA KEV (added 2022-03-25) and has an EPSS 30-day probability of 0.99323 (99.9th percentile). Multiple references are tagged Exploit, including Metasploit and Exploit-DB entries, indicating public exploit code exists.

What to do

• Upgrade Rejetto HFS to 2.3c or later, or replace the product if it is no longer maintained.
• Remove HFS from direct internet exposure; restrict access to trusted networks or place it behind an authenticated reverse proxy.
• Run the HFS service under a low-privilege account with no interactive logon rights to limit post-exploitation impact.
• Monitor vendor and CISA guidance for this CVE and apply the required action from the KEV entry.

Detection

• Search web or proxy logs for HFS search requests containing %00 sequences or other null-byte patterns.
• Alert on unexpected child processes spawned by the HFS process (for example cmd.exe, powershell.exe, or shell binaries).
• Monitor for outbound connections from the HFS host to unfamiliar addresses following search requests.
• Audit hosts for HFS versions below 2.3c and flag any internet-facing instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.