CVE-2014-5401
No exploitation reported by the sources we read.
- Published2019-03-26
- WeaknessCWE-94
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versions of MedNet can be upgraded to MedNet 6.1.
Timeline
dates in UTC- 2019-03-2617:29CVE publishedNVD
Observed activity
isMalicious corpus · updated 2026-10-23 18:48 UTCBlock these indicators
- Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2014-5401?format=txt
- CSV export: https://api.ismalicious.com/edl/cve/CVE-2014-5401?format=csv
- TAXII collection of exploited CVEs
- The EDL and CSV take an API key on the Pro plan.
Versions per branch
NVD| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 5.8 | ≤ 5.8 | no fix published | NVD |
as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.
Distribution builds and vendor advisories
Packages from OSV.dev and products from the vendors' CSAF advisories.
version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.
Vendor advisories
Hospira MedNet Vulnerabilitie
Hospira MedNet: <=5.8
Fix
- Mitigation from the vendor CISA ICSA-15-090-03 · 1 productHospira has developed a new version of the MedNet software, MedNet 6.1
- Mitigation from the vendor CISA ICSA-15-090-03 · 1 productHospira reports that MedNet 6.1 no longer uses hard-coded passwords, hard-coded cryptographic keys, and no longer stores passwords in clear text
- Mitigation from the vendor CISA ICSA-15-090-03 · 1 productExisting versions of MedNet can be upgraded to MedNet 6.1
- Mitigation from the vendor CISA ICSA-15-090-03 · 1 productHospira has produced mitigation recommendations that help mitigate the vulnerability in the vulnerable version of JBoss Enterprise Application Platform software, used in the MedNet software
- Mitigation from the vendor CISA ICSA-15-090-03 · 1 productThis has been addressed by Hospira through issuance of the following knowledge based articles: Improving Security in Hospira MedNet 5.5 (August 2014) and Improving Security in Hospira MedNet 5.8 (August 2014)
- Mitigation from the vendor CISA ICSA-15-090-03 · 1 productFor additional information about Hospira’s new releases and mitigation recommendations, contact Hospira’s technical support at 1-800-241-4002.
Detection
- Nuclei template
- none so far ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof-of-concept repositories
- none listed PoC-in-GitHub
Sources
Technical details
- CVSS v3 Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 2019-03-26
- Last Modified
- 2026-06-17
- NVD status
- Modified
Frequently asked questions
What is CVE-2014-5401?
Is CVE-2014-5401 actively exploited?
What is the CVSS score for CVE-2014-5401?
Hear about the next vulnerability in your software
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.