CVE-2014-1209

critical

Published 2014-04-11 · Modified 2026-05-06

CVSS v3

—

CVSS v2

9.3

VIR risk

9.3

Description

VMware vSphere Client 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 does not properly validate updates to Client files, which allows remote attackers to trigger the downloading and execution of an arbitrary program via unspecified vectors.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://www.vmware.com/security/advisories/VMSA-2014-0003.html

Application impact

Vendor	Product	Versions
vmware	vsphere_client	`4.0`
vmware	vsphere_client	`4.1`
vmware	vsphere_client	`5.0`
vmware	vsphere_client	`5.1`

References

http://www.vmware.com/security/advisories/VMSA-2014-0003.html
http://www.vmware.com/security/advisories/VMSA-2014-0003.html

CWEs

CWE-20

Verify integrity in audit chain (admin only). AS-IS.