CVE-2014-6271 (Shellshock): Bash command injection on exposed SonicWall appliances
The short version: Shellshock (CVE-2014-6271) is a flaw in the GNU Bash shell that lets an attacker smuggle commands through crafted environment variables — reachable, on affected web-facing devices, via a simple HTTP request. It still shows up on legacy SonicWall appliances that shell out to Bash through CGI scripts, and it's in CISA's KEV catalog. Where a vulnerable device is exposed, an unauthenticated attacker can run commands on it. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated RCE on exposed, affected devices |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~100% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-07-28 |
| Known exploited? | Yes — mass exploited since 2014; one of the most-scanned flaws on the internet |
| Vulnerability type | CWE-78 OS command injection → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | GNU Bash through 4.3 — here, legacy SonicWall appliances that invoke Bash via CGI |
| Fixed in | Patched Bash packages / updated appliance firmware (e.g., SonicWall 8.0.0.5 per the definition) |
What you need to know
Shellshock is a command injection in Bash. Bash mishandled specially crafted environment variables, executing trailing commands attackers tacked on. On web-facing systems that pass request data into environment variables and then call Bash — classic CGI scripts — an attacker can inject that payload through an HTTP header (like User-Agent) and have the device run their commands.
Why it still matters years later:
- Legacy appliances linger. SonicWall SMA and similar devices that shell out to Bash through CGI endpoints can still be vulnerable if they were never updated.
- It's trivial and pre-auth. A single crafted request, no credentials — and reliable, automatable exploitation.
- The internet never stopped scanning for it. Shellshock remains one of the most probed vulnerabilities in existence, with EPSS near the ceiling.
How serious we see it
High — where a vulnerable, exposed device exists.
The 9.8 has held up for a decade: unauthenticated, network-reachable command execution, mass-exploited, and in KEV. On an internet-facing security appliance, running attacker commands means control of the device that guards your edge. The reassuring, bounded part is that this is old and well-understood — mainstream systems patched Bash years ago, so the real exposure today is specific legacy appliances and forgotten hosts. The action is to find those and update or retire them.
Recommendations
Straight from CISA and vendor guidance:
- Patch or replace the device. Update affected appliance firmware (e.g., the fixed SonicWall build), or retire end-of-life hardware that can't be patched.
- Patch Bash on general-purpose hosts. Ensure any Linux/Unix systems use post-Shellshock Bash packages.
- Confirm your exposure first. Verify whether any legacy, internet-facing appliance still exposes CGI endpoints that call Bash.
- Restrict reachability. Keep management and CGI surfaces off the public internet where you can.
- Hunt on suspect devices. Given how long this has been exploited, review exposed legacy devices for signs of prior compromise.
How BreachRisk sees it
BreachRisk discovers internet-facing SonicWall and similar appliances from little more than your domain, fingerprints them, and flags exposure tied to Shellshock — raised to the top because it's in KEV. Where authorized, it goes a step past a scanner: it sends a safe, bounded check with a benign Shellshock payload that reads a harmless system file, confirming whether the device actually executes injected commands — a controlled proof, not a destructive one.
That's the difference between "this looks like a legacy device" and "we confirmed it runs injected commands" — surfaced continuously, so a forgotten appliance doesn't stay a quiet foothold.