CVE-2014-6271
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,...
Affects 86 products across 18 vendors.
Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2014-6271, also known as 'ShellShock', affects GNU Bash versions up to 4.3. This vulnerability allows remote attackers to execute arbitrary code via crafted environment variables, leading to potential system compromise. The vulnerability has a high CVSS score of 9.8 and is widely exploited in the wild, affecting multiple vendors and systems.
BSID: BS-2014-GLOBAL-187117-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2014-6271?
What is the CVSS score for CVE-2014-6271?
Is CVE-2014-6271 actively exploited?
How do I remediate CVE-2014-6271?
What systems are affected by CVE-2014-6271?
What NERC-CIP standard applies to CVE-2014-6271?
What IEC 62443 requirement maps to CVE-2014-6271?
| CVE ID | CVE-2014-6271 |
|---|---|
| BSID | BS-2014-GLOBAL-187117-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2014-09-24 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 90% |
| Weakness (CWE) | |
| Domains | |
| Source | NVD |
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from how GNU Bash processes trailing strings after function definitions in the values of environment variables. Attackers can exploit this by setting malicious environment variables that are processed by Bash, leading to arbitrary code execution. Common attack vectors include the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, and scripts executed by DHCP clients.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Apple | Mac Os X | ≥ 10.0.0, < 10.10.0 |
| Arista | Eos | ≥ 4.9.0, < 4.9.12 ≥ 4.10.0, < 4.10.9 ≥ 4.11.0, < 4.11.11 ≥ 4.12.0, < 4.12.9 ≥ 4.13.0, < 4.13.9 ≥ 4.14.0, < 4.14.4f |
| Canonical | Ubuntu Linux | 10.04 12.04 14.04 |
| Checkpoint | Security Gateway | < r77.30 |
| Citrix | Netscaler Sdx (device & firmware) | < 9.3.67.5r1 ≥ 10.5, < 10.5.52.11r1 ≥ 10, < 10.1.129.11r1 |
| Debian | Debian Linux | 7.0 |
| F5 | Big-Ip Policy Enforcement Manager | 11.6.0 ≥ 11.3.0, ≤ 11.5.1 |
| F5 | Big-Ip Advanced Firewall Manager | 11.6.0 ≥ 11.3.0, ≤ 11.5.1 |
| F5 | Enterprise Manager | ≥ 2.1.0, ≤ 2.3.0 ≥ 3.0.0, ≤ 3.1.1 |
| F5 | Big-Ip Webaccelerator | ≥ 10.0.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.3.0 |
| F5 | Big-Ip Wan Optimization Manager | ≥ 10.0.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.3.0 |
| F5 | Big-Ip Local Traffic Manager | 11.6.0 ≥ 10.0.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.5.1 |
| F5 | Big-Ip Link Controller | 11.6.0 ≥ 10.0.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.5.1 |
| F5 | Big-Ip Global Traffic Manager | 11.6.0 ≥ 10.0.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.5.1 |
| F5 | Big-Ip Edge Gateway | ≥ 10.1.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.3.0 |
| F5 | Big-Ip Analytics | 11.6.0 ≥ 11.0.0, ≤ 11.5.1 |
| F5 | Big-Ip Access Policy Manager | 11.6.0 ≥ 10.1.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.5.1 |
| F5 | Arx (device & firmware) | ≥ 6.0.0, ≤ 6.4.0 |
| F5 | Big-Ip Protocol Security Module | ≥ 10.0.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.4.1 |
| F5 | Big-Ip Application Security Manager | 11.6.0 ≥ 10.0.0, ≤ 10.2.4 ≥ 11.0.0, ≤ 11.5.1 |
| F5 | Traffix Signaling Delivery Controller | 3.3.2 3.4.1 3.5.1 4.1.0 ≥ 4.0.0, ≤ 4.0.5 |
| F5 | Big-Iq Security | ≥ 4.0.0, ≤ 4.4.0 |
| F5 | Big-Iq Device | ≥ 4.2.0, ≤ 4.4.0 |
| F5 | Big-Iq Cloud | ≥ 4.0.0, ≤ 4.4.0 |
| F5 | Big-Ip Application Acceleration Manager | 11.6.0 ≥ 11.4.0, ≤ 11.5.1 |
| Gnu | Bash | ≤ 4.3 |
| Ibm | Stn6800 (device & firmware) | ≥ 3.8.0.0, < 3.8.0.07 ≥ 3.9.1.0, < 3.9.1.08 ≥ 4.1.2.0, < 4.1.2.06 |
| Ibm | Stn7800 (device & firmware) | ≥ 3.8.0.0, < 3.8.0.07 ≥ 3.9.1.0, < 3.9.1.08 ≥ 4.1.2.0, < 4.1.2.06 |
| Ibm | Qradar Security Information And Event Manager | 7.1.0 7.1.1 7.1.2 7.2 7.2.0 7.2.1+9 more7.2.2 7.2.3 7.2.4 7.2.5 7.2.6 7.2.7 7.2.8 7.2.8.15 7.2.9 |
| Ibm | Smartcloud Provisioning | 2.1.0 |
| Ibm | Flex System V7000 (device & firmware) | ≥ 1.1.0.0, < 7.1.0.11 ≥ 7.2.0.0, < 7.2.0.9 ≥ 7.3.0.0, < 7.3.0.7 |
| Ibm | Storwize V3700 (device & firmware) | ≥ 1.1.0.0, < 7.1.0.11 ≥ 7.2.0.0, < 7.2.0.9 ≥ 7.3.0.0, < 7.3.0.7 |
| Ibm | Storwize V3500 (device & firmware) | ≥ 1.1.0.0, < 7.1.0.11 ≥ 7.2.0.0, < 7.2.0.9 ≥ 7.3.0.0, < 7.3.0.7 |
| Ibm | San Volume Controller (device & firmware) | ≥ 1.1.0.0, < 7.1.0.11 ≥ 7.2.0.0, < 7.2.0.9 ≥ 7.3.0.0, < 7.3.0.7 |
| Ibm | Storwize V5000 (device & firmware) | ≥ 1.1.0.0, < 7.1.0.11 ≥ 7.2.0.0, < 7.2.0.9 ≥ 7.3.0.0, < 7.3.0.7 |
| Ibm | Pureapplication System | 2.0.0.0 ≥ 1.0.0.0, ≤ 1.0.0.4 ≥ 1.1.0.0, ≤ 1.1.0.4 |
| Ibm | Security Access Manager For Web 8.0 Firmware | 8.0.0.2 8.0.0.3 8.0.0.5 |
| Ibm | Infosphere Guardium Database Activity Monitoring | 8.2 9.0 9.1 |
| Ibm | Qradar Risk Manager | 7.1.0 |
| Ibm | Qradar Vulnerability Manager | 7.2.0 7.2.1 7.2.2 7.2.3 7.2.4 7.2.6+1 more7.2.8 |
| Ibm | Smartcloud Entry Appliance | 2.3.0 2.4.0 3.1.0 3.2.0 |
| Ibm | Software Defined Network For Virtual Environments | < 1.2.1 |
| Ibm | Starter Kit For Cloud | 2.2.0 |
| Ibm | Workload Deployer | ≥ 3.1.0, ≤ 3.1.0.7 |
| Ibm | Security Access Manager For Mobile 8.0 Firmware | 8.0.0.1 8.0.0.2 8.0.0.3 8.0.0.5 |
| Ibm | Security Access Manager For Web 7.0 Firmware | 7.0.0.1 7.0.0.2 7.0.0.3 7.0.0.4 7.0.0.5 7.0.0.6+2 more7.0.0.7 7.0.0.8 |
| Ibm | Storwize V7000 (device & firmware) | ≥ 1.1.0.0, < 1.4.3.5 ≥ 1.5.0.0, < 1.5.0.4 ≥ 7.2.0.0, < 7.2.0.9 ≥ 7.3.0.0, < 7.3.0.7 |
| Ibm | Stn6500 (device & firmware) | ≥ 3.8.0.0, < 3.8.0.07 ≥ 3.9.1.0, < 3.9.1.08 ≥ 4.1.2.0, < 4.1.2.06 |
| Johnsoncontrols | — | — |
| Mageia | Mageia | 3.0 4.0 |
| Novell | Zenworks Configuration Management | 10.3 11 11.1 11.2 11.3.0 |
| Novell | Open Enterprise Server | 2.0 11.0 |
| Opensuse | Opensuse | 12.3 13.1 13.2 |
| Oracle | Linux | 4 5 6 |
| Qnap | Qts | 4.1.1 < 4.1.1 |
| Redhat | Virtualization | 3.4 |
| Redhat | Enterprise Linux For Power Big Endian | 5.0_ppc 5.9_ppc 6.0_ppc64 6.4_ppc64 7.0_ppc64 |
| Redhat | Enterprise Linux For Ibm Z Systems | 5.9_s390x 6.4_s390x 6.5_s390x 7.3_s390x 7.4_s390x 7.5_s390x+2 more7.6_s390x 7.7_s390x |
| Redhat | Enterprise Linux Eus | 5.9 6.4 6.5 7.3 7.4 7.5+2 more7.6 7.7 |
| Redhat | Enterprise Linux Workstation | 5.0 6.0 7.0 |
| Redhat | Enterprise Linux Server | 5.0 6.0 7.0 |
| Redhat | Enterprise Linux Desktop | 5.0 6.0 7.0 |
| Redhat | Enterprise Linux | 4.0 5.0 6.0 7.0 |
| Redhat | Enterprise Linux Server Aus | 5.6 5.9 6.2 6.4 6.5 7.3+3 more7.4 7.6 7.7 |
| Redhat | Enterprise Linux Server Tus | 6.5 7.3 7.6 7.7 |
| Redhat | Enterprise Linux For Power Big Endian Eus | 6.5_ppc64 7.3_ppc64 7.4_ppc64 7.5_ppc64 7.6_ppc64 7.7_ppc64 |
| Redhat | Enterprise Linux Server From Rhui 6 | 5.0 6.0 7.0 |
| Redhat | Enterprise Linux Server From Rhui | 5.0 6.0 7.0 |
| Redhat | Enterprise Linux For Scientific Computing | 6.0 7.0 |
| Redhat | Gluster Storage Server For On-Premise | 2.1 |
| Suse | Linux Enterprise Desktop | 11 12 |
| Suse | Linux Enterprise Server | 10 11 12 |
| Suse | Linux Enterprise Software Development Kit | 11 12 |
| Suse | Studio Onsite | 1.3 |
| Vmware | Vcenter Server Appliance | 5.0 5.1 5.5 |
| Vmware | Esx | 4.0 4.1 |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2022-01-28) |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement strict input validation and sanitization for all environment variables and user inputs that interact with Bash. Use secure coding practices and consider using alternative shells that are not affected by this vulnerability.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to critical cyber assets, potentially leading to the compromise of control systems and the disruption of power delivery.
This CVE maps to SR 7.6 because it involves the protection against unauthorized access to industrial control systems, which is essential for maintaining the integrity and availability of operational processes.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 3367d600f880f98366af673630804370e1378f2e444f6778fa806c5c2a1f0c9e9820cfba82d2a0a09e0b81f195dfb32c97c1fbe6022b414c3808a109f7a0fd22 |
This Vulnerability Is Being Actively Exploited
CVE-2014-6271 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →