CVE-2014-7169: GNU Bash environment variable function parsing command injection (Shellshock variant)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing, and an EPSS probability near 1.0 indicate a remotely exploitable, actively exploited flaw with severe impact.

What it is

GNU Bash through 4.3 bash43-025 processes trailing strings after malformed function definitions in environment variable values, allowing command injection across a privilege boundary. This is an incomplete fix for CVE-2014-6271, so systems patched only for the original Shellshock flaw remain vulnerable. It matters because Bash is widely deployed and reachable through common services that pass attacker-controlled environment variables.

Impact

A remote attacker can write files and potentially execute arbitrary commands with the privileges of the process invoking Bash. The full scope of impact is described as possibly unknown, but file write and command execution are demonstrated.

Attack surface

Reached remotely over the network without authentication or user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Demonstrated vectors include OpenSSH ForceCommand, Apache mod_cgi/mod_cgid, and DHCP client scripts where the environment is set across a privilege boundary.

Exploitation

Listed in CISA KEV since 2022-01-28 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.9994 (99.97th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in this record.

What to do

• Apply vendor Bash updates that address CVE-2014-7169, not just the original CVE-2014-6271 fix.
• Verify the installed Bash version is newer than bash43-025 and re-test after patching.
• Restrict or disable CGI and other services that pass untrusted environment variables into Bash where feasible.
• Limit exposure of SSH ForceCommand and DHCP client script paths that cross a privilege boundary.
• Monitor vendor advisories for the listed affected products and apply the corresponding errata.

Detection

• Search process and command-line logs for Bash invocations containing function definitions such as '() {' in environment-derived arguments.
• Monitor web server and CGI logs for requests carrying malformed function-definition payloads in headers or parameters.
• Alert on unexpected file writes or child process creation by CGI, sshd, or DHCP-related processes.
• Audit hosts for Bash versions at or below bash43-025 to identify unpatched systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.