CVE-2014-8686

CRITICAL

CodeIgniter <2.2.0 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2014-8686. PoCs published by Metasploit, including Metasploit module exploits/linux/http/seagate_nas_php_exec_noauth.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated remote command execution vulnerability in Seagate Business NAS devices via a local file inclusion vulnerability in the CodeIgniter session cookie. It manipulates the session cookie to gain admin privileges and then injects a PHP payload to achieve remote code execution.

Description

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/36264

This Metasploit module exploits an unauthenticated remote command execution vulnerability in Seagate Business NAS devices via a local file inclusion vulnerability in the CodeIgniter session cookie. It manipulates the session cookie to gain admin privileges and then injects a PHP payload to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Seagate Business NAS (STBN300)
No auth needed
Prerequisites: Network access to the target device · Target device must be running vulnerable firmware
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb

This Metasploit module exploits an unauthenticated remote command execution vulnerability in Seagate Business NAS devices via a local file inclusion flaw in the CodeIgniter session cookie. It manipulates the session cookie to gain admin privileges and injects a PHP payload to achieve RCE.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Seagate Business NAS (e.g., STBN300)
No auth needed
Prerequisites: Network access to the target device · Target device must be vulnerable to CVE-2014-8684, CVE-2014-8686, or CVE-2014-8687
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory x_refsource_misc
https://beyondbinary.io/articles/seagate-nas-rce/
Vendor Advisory x_refsource_confirm
https://codeigniter.com/userguide2/changelog.html

Scores

CVSS v3 9.8
EPSS 0.3404
EPSS Percentile 97.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-310
Status published
Products (1)
codeigniter/codeigniter < 2.1.4
Published Sep 19, 2017
Tracked Since Feb 18, 2026