How do I check whether I am affected by CVE-2014-6287?

Open HFS (hfs.exe) and read the version in the window title or the About box. Any 2.3, 2.3a or 2.3b is vulnerable. Check for exposed instances: a request to http://HOST:PORT/?search==%00{.exec|calc.} launches calc on a vulnerable server, so only test hosts you own. Also look for hfs.exe running and listening on a port, and check web logs for requests with %00 or {.exec in the search parameter.

What is the fix for CVE-2014-6287?

Upgrade to HFS 2.3c or later (CERT/CC VU#251276). Because 2.3c is itself affected by CVE-2014-7226 (file comment macro injection), use 2.3d or later (rejetto lists 2.3d as security fixes). 2.3m and earlier are affected by CVE-2024-23692, so the 2.x line is unsupported and best replaced with HFS 3. If you cannot upgrade, stop HFS and do not expose it to the internet. If it was exposed while on 2.3 to 2.3b, treat the host as compromised.

Who is not affected by CVE-2014-6287?

Not affected if: not-running-hfs.

Live › vulnerability › CVE-2014-6287

Go to dashboard

critical10.0Exploited in the wildPackage

Rejetto HTTP File Server (HFS): Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Rejetto HFS 2.3, 2.3a and 2.3b fail to handle a null byte (%00) in the search action. The parserLib.pas macro parser then runs the commands that follow it. An unauthenticated remote attacker gets command execution on the Windows host. It is exploited in the wild, is on CISA KEV, and has a public Metasploit module and PoC.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

10.0

critical

scored by [email protected]

known so far6 of 6

First public: Oct 7, 2014 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: 1 PoC repo on GitHub
EPSS: 99.3% in 30d

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 25, 2022 and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Remote attacker runs arbitrary programs on the server host.
CVSS said: 10.0. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2014-6287

Go to dashboard

critical10.0Exploited in the wildPackage

Rejetto HTTP File Server (HFS): Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

10.0

critical

scored by [email protected]

known so far6 of 6

First public: Oct 7, 2014 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: 1 PoC repo on GitHub
EPSS: 99.3% in 30d

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Mar 25, 2022 and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Remote attacker runs arbitrary programs on the server host.
CVSS said: 10.0. The facts above agree.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Rejetto HTTP File Server (HFS)	vendor	–	–
Rejetto HTTP File Server (HFS)	vendor	>= 2.3, < 2.3c	2.3c

Rejetto HTTP File Server (HFS): Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

Rejetto HTTP File Server (HFS): Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Why it is critical, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources