CVE-2014-2846

WD Arkeia Virtual Appliance Firmware < 10.2.7 - Path Traversal and Remote Code Execution via Lang Cookie Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-2846. PoCs published by SEC Consult.

AI-analyzed exploit summary The advisory describes a path traversal vulnerability in WD Arkeia Virtual Appliance (AVA) that allows unauthenticated remote attackers to retrieve arbitrary files and execute system commands via a maliciously crafted 'lang' cookie. The vulnerability exists in the /opt/arkeia/wui/htdocs/index.php script due to improper input validation.

Description

Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin.

Exploits (1)

exploitdb WRITEUP
by SEC Consult · textwebappsphp
https://www.exploit-db.com/exploits/33005

The advisory describes a path traversal vulnerability in WD Arkeia Virtual Appliance (AVA) that allows unauthenticated remote attackers to retrieve arbitrary files and execute system commands via a maliciously crafted 'lang' cookie. The vulnerability exists in the /opt/arkeia/wui/htdocs/index.php script due to improper input validation.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WD Arkeia Virtual Appliance (AVA) versions 7.0.3 to 10.2.7
No auth needed
Prerequisites: Network access to the vulnerable web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Apr/257
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/531910/100/0/threaded

Scores

EPSS 0.0876
EPSS Percentile 94.5%

Details

CWE
CWE-22
Status published
Products (1)
westerndigital/arkeia_virtual_appliance_firmware < 10.2.7
Published Apr 28, 2014
Tracked Since Feb 18, 2026