Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2014-4982: LPAR2RRD lets attackers run commands on server

CVE-2014-4982 · published 6 years ago

Summary

Versions of LPAR2RRD up to 4.53 and 3.5 can be tricked into executing any command on the application server. This could let an attacker take control of the system or steal data. Upgrade to a newer version or apply the vendor's security update as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
xorux	lpar2rrd	<= 3.50 >= 4.00, <= 4.53 `cpe:2.3:a:xorux:lpar2rrd::::::::`

Original advisory text

LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.

References

http://packetstormsecurity.com/files/127593/LPAR2RRD-3.5-4.53-Command-Injection.... Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2014/07/23/6 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/68850 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94785 Third Party Advisory VDB Entry

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

5% chance of attack within 30 days

Type

CWE-77Command Injection

Timeline

Published10 Jan 2020

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2014-4982 · NVD

Track software like this

Free during beta