UpHeron
All vulnerabilities

Servers and applications

CVE-2014-3391

Untrusted search path vulnerability in Cisco ASA Software 8.x before 8.4(3), 8.5, and 8.7 before 8.7(1.13) allows local users to gain privileges by placing a Trojan horse library file in external memory, leading to library use after device reload because of an incorrect LD_LIBRARY_PATH value, aka Bug ID CSCtq52661.

Severity
Medium 6.8
Published
10 Oct 2014
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
0.4% in the next 30 daysHigher than 34% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Improper input validation (CWE-20)
Attack
Needs local access · Needs a login
Attacker can
Read data · Change data · Take it down
CVSS vector
AV:L/AC:L/Au:S/C:C/I:C/A:C
Sources
NVD

Affected software

SoftwareAffected versions
Cisco ASA and Firepower Threat DefenseServers and applications · cpe:o:cisco:adaptive_security_appliance_software
  • Version 8.7.1.13
  • Version 8.7.1.11
  • Version 8.7.1.7
  • Version 8.7.1.4
All 65 release lines
  • Version 8.2.0.45
  • Version 8.2.1
  • Version 8.2.1.1
  • Version 8.2.2
  • Version 8.2.2.10
  • Version 8.2.2.12
  • Version 8.2.2.16
  • Version 8.2.2.17
  • Version 8.2.3
  • Version 8.2.4
  • Version 8.2.4.1
  • Version 8.2.4.4
  • Version 8.2.5
  • Version 8.2.5.13
  • Version 8.2.5.22
  • Version 8.2.5.26
  • Version 8.2.5.33
  • Version 8.2.5.40
  • Version 8.2.5.41
  • Version 8.2.5.46
  • Version 8.2.5.48
  • Version 8.2.5.50
  • Version 8.3.1
  • Version 8.3.1.1
  • Version 8.3.1.4
  • Version 8.3.1.6
  • Version 8.3.2
  • Version 8.3.2.4
  • Version 8.3.2.13
  • Version 8.3.2.23
  • Version 8.3.2.25
  • Version 8.3.2.31
  • Version 8.3.2.33
  • Version 8.3.2.34
  • Version 8.3.2.37
  • Version 8.3.2.39
  • Version 8.3.2.40
  • Version 8.3.2.41
  • Version 8.4.1
  • Version 8.4.1.3
  • Version 8.4.1.11
  • Version 8.4.2
  • Version 8.4.2.1
  • Version 8.4.2.8
  • Version 8.4.3
  • Version 8.4.3.8
  • Version 8.4.3.9
  • Version 8.4.4
  • Version 8.4.4.1
  • Version 8.4.4.3
  • Version 8.4.4.5
  • Version 8.4.4.9
  • Version 8.4.5
  • Version 8.4.5.6
  • Version 8.4.6
  • Version 8.4.7
  • Version 8.4.7.3
  • Version 8.4.7.15
  • Version 8.4.7.22
  • Version 8.7.1
  • Version 8.7.1.3
  • Version 8.7.1.4
  • Version 8.7.1.7
  • Version 8.7.1.11
  • Version 8.7.1.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-3391
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-3391