CVE-2014-9618: Netsweeper Client Filter Admin authentication bypass via showdeny action

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable authentication bypass in an administrative portal with high CVSS impact and very high EPSS, though not in KEV.

What it is

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 fails to properly enforce authentication. A remote attacker can reach the default URL with a showdeny action and bypass authentication, then create arbitrary profiles. This matters because the affected component is an administrative portal, so unauthenticated access undermines the control plane of the filtering deployment.

Impact

An unauthenticated attacker gains administrative capability to create arbitrary profiles, which can alter filtering and policy behavior on the Netsweeper deployment. The CVSS 3.0 vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network through the Client Filter Admin portal's default URL using a showdeny action; the CVSS vector indicates no privileges and no user interaction are required. No further detail on the exact request path is given in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.72696 (99.4th percentile), and references include Exploit-DB and Packet Storm advisories, indicating public exploit material exists. No ransomware usage is documented.

What to do

• Upgrade Netsweeper to 3.1.10, 4.0.9, 4.1.2 or later as applicable to the deployed branch.
• Restrict network access to the Client Filter Admin portal to trusted management networks only.
• Place the admin portal behind authentication-enforcing reverse proxy or VPN where feasible.
• Audit existing profiles for unauthorized additions and remove any that cannot be attributed.
• Monitor vendor advisories for updated guidance on the affected branches.

Detection

• Review web logs for requests to the Client Filter Admin default URL containing a showdeny action, especially from unauthenticated or unexpected source addresses.
• Alert on profile creation events in Netsweeper audit logs that lack a corresponding authenticated admin session.
• Baseline normal admin portal request patterns and flag deviations in source IP, user agent or request parameters.
• Correlate portal access with authentication logs to find successful actions without a preceding login.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.