# CVE-2014-2321

> As of 2024-09-16, CVE-2014-2321 is a vulnerability, EPSS 59.2% (99.1th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2014-2321, most recently “TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain”.

**Last updated:** 2024-09-16

## What is CVE-2014-2321?

web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.

The identifier was first published 4614 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 59.2% probability of exploitation in the next 30 days, higher than 99.1% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 6.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2014-03-11, last modified 2024-09-16

## Is CVE-2014-2321 being exploited?

Weaponised exploit code for CVE-2014-2321 is publicly available. 3 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (`http/cves/2014/CVE-2014-2321.yaml`). It currently carries a trending score of 40 in the Threadlinqs vulnerability feed.

- [injectionmethod/ZTE-Vuln-4-Skids](https://github.com/injectionmethod/ZTE-Vuln-4-Skids) (github)
- [injectionmethod/Windows-ZTE-Loader](https://github.com/injectionmethod/Windows-ZTE-Loader) (github)
- [trickest/cve](https://github.com/trickest/cve/blob/main/2014/CVE-2014-2321.md) (trickest)

## Affected products and versions

No affected-product or package list has been recorded for CVE-2014-2321 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

## How to fix CVE-2014-2321

No vendor patch reference has been recorded for CVE-2014-2321 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2014-2321

1 tracked threat in the Threadlinqs corpus references CVE-2014-2321, either in the campaign’s CVE list or as an indicator on the campaign record.

- [TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain](https://intel.threadlinqs.com/threat/TL-2026-1366) — HIGH · 2026-07-15

## Sources

Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on 2026-10-10.

**Third-party advisory**

- [kb.cert.org — third party advisory](http://www.kb.cert.org/vuls/id/600724)

**Other references**

- [myxzy.com](http://www.myxzy.com/post-411.html)
- [community.rapid7.com](https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor)

Canonical: https://intel.threadlinqs.com/cve/CVE-2014-2321
Full detection coverage and IOCs for threats exploiting CVE-2014-2321 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp