What is CVE-2014-4936?

CVE-2014-4936 is a vulnerability in Malwarebytes Anti-Exploit, classified under Insufficient Verification of Data Authenticity. Published 2014-12-16.

Is CVE-2014-4936 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Malwarebytes Anti-Exploit

CVE-2014-4936

The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 and earlier allow man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.

EPSS: 0.168 (96.7th percentile) — read the EPSS interpretation.

Affected products

Malwarebytes Malwarebytes_anti-exploit
Malwarebytes Malwarebytes_anti-malware
N/a — versions n/a

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

Public proof-of-concept exploits

0x3a/CVE-2014-4936
rapid7/metasploit-framework

References

cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2014-4936?: CVE-2014-4936 is a vulnerability in Malwarebytes Anti-Exploit, classified under Insufficient Verification of Data Authenticity. Published 2014-12-16.
Is CVE-2014-4936 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.