CVE-2014-7285: Symantec Web Gateway management console OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote authenticated OS command injection on a security appliance with public exploit code and very high EPSS, though it requires valid console credentials.

What it is

The management console of the Symantec Web Gateway appliance before 5.2.2 passes attacker-controlled input into unspecified PHP scripts without sanitizing it, allowing OS command injection. An attacker who can authenticate to the console can run arbitrary commands on the appliance, which is a security control point for outbound web traffic.

Impact

An authenticated attacker gains arbitrary OS command execution on the SWG appliance, enabling full compromise of the device and any data or credentials it handles.

Attack surface

Reached remotely over the network through the management console's PHP scripts; the CVSS vector (AV:N/AC:L/Au:S) indicates network access with low complexity but requires a valid authenticated session. No user interaction is indicated.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but public exploit code exists (Exploit-DB 36263, Packet Storm) and EPSS is 0.503 (98.9th percentile), indicating meaningful likelihood of exploitation.

What to do

• Upgrade Symantec Web Gateway to 5.2.2 or later per the vendor advisory.
• Restrict management console access to a dedicated administrative network and block it from untrusted networks.
• Enforce strong unique credentials and least privilege for console accounts; audit and remove unused accounts.
• Monitor the appliance for unexpected outbound connections or process execution that would indicate post-exploitation activity.

Detection

• Review management console and web server logs for requests to PHP scripts containing shell metacharacters or command strings.
• Alert on unexpected child processes or shell execution spawned by the web server/PHP process on the appliance.
• Monitor for anomalous outbound traffic or new listening services originating from the SWG appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.