CVE-2014-3857

MEDIUM 6.5CVE-2014-3857 · Published 03/07/2014 · updated 17/06/2026

In short

CVE-2014-3857 is a MEDIUM (CVSS 6.5) vulnerability affecting control (kerio).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
control kerio	`= 8.3.0≤ 8.3.1`	No fix yet

Description

Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) x_16 or (2) x_17 parameter to print.php.

References

fereidani.com/articles/show/76_kerio_control_8_3_1_boolean_based_blind_sql_injection · Exploit
osvdb.org/show/osvdb/108584
packetstormsecurity.com/files/127320/Kerio-Control-8.3.1-Blind-SQL-Injection.html
secunia.com/advisories/59215
exploit-db.com/exploits/33954
kerio.com/support/kerio-control/release-history
securityfocus.com/archive/1/532607/100/0/threaded

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free