CVE-2014-125121

🗓️ 31 Jul 2025 14:52:45Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Array Networks vAPV and vxAG have a privilege escalation vulnerability via hardcoded credentials leading to system compromise.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2014-125121	29 May 201815:50	–	circl
CNNVD	Array Networks vAPV和Array Networks vxAG 安全漏洞	31 Jul 202500:00	–	cnnvd
Cvelist	CVE-2014-125121 Array Networks vAPV and vxAG Default Credential Privilege Escalation	31 Jul 202514:52	–	cvelist
EUVD	EUVD-2014-9812	7 Oct 202500:30	–	euvd
Metasploit	Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution	3 Feb 201400:00	–	metasploit
NVD	CVE-2014-125121	31 Jul 202515:15	–	nvd
OpenVAS	Known/Static SSH Private Key Used (TCP)	14 Oct 201500:00	–	openvas
OpenVAS	Array Networks vxAG/xAPV Multiple Vulnerabilities (Mar 2014)	20 Mar 201400:00	–	openvas
Positive Technologies	PT-2025-31541 · Undefined · Undefined	31 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2014-125121	2 Aug 202520:22	–	redhatcve

Vulners

CNA

Node

array_networks vapvMatch8.3.2.17

array_networks vxagMatch9.2.0.34

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "/ca/bin/monitor.sh"
    ],
    "product": "vAPV",
    "vendor": "Array Networks",
    "versions": [
      {
        "status": "affected",
        "version": "8.3.2.17"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "modules": [
      "/ca/bin/monitor.sh"
    ],
    "product": "vxAG",
    "vendor": "Array Networks",
    "versions": [
      {
        "status": "affected",
        "version": "9.2.0.34"
      }
    ]
  }
]

Source	Link
packetstorm	www.packetstorm.news/files/id/125761
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb
vulncheck	www.vulncheck.com/advisories/array-networks-vapv-vxag-default-credential-privilege-escalation
exploit-db	www.exploit-db.com/exploits/32440

Parameter	Position	Path	Description	CWE
/ca/bin/monitor.sh	path	/ca/bin/monitor.sh	Privilege escalation by overwriting a world-writable startup script used by root-level processes.	CWE-798, CWE-732
monitor.sh	path	/ca/bin/monitor.sh	Privilege escalation by overwriting a world-writable startup script used by root-level processes.	CWE-798, CWE-732
world-writable permission	path	/ca/bin/monitor.sh	Privilege escalation by overwriting a world-writable startup script used by root-level processes.	CWE-798, CWE-732
/ca/bin/backend	path	/ca/bin/backend	Execution of attacker payload as root via the backend tool when debugging is enabled.	CWE-798, CWE-732
-c	path	/ca/bin/backend	Execution of attacker payload as root via the backend tool when debugging is enabled.	CWE-798, CWE-732
debug monitor on	path	/ca/bin/backend	Execution of attacker payload as root via the backend tool when debugging is enabled.	CWE-798, CWE-732

17 Jun 2026 00:04Current

7High risk

Vulners AI Score7

CVSS 410

EPSS0.00853

SSVC