CVE-2014-8169

automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

Published: 2015-03-18 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2014-8169 is rated Low Risk (26.6/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.34%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2014-8169

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.11% 0.34% +0.23%
2 2025-03-17 0.04% 0.11% +0.07%
3 2023-03-07 — 0.04% —

Full EPSS history (6 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2014-8169

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.4 2.0 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 3.4 6.4 [email protected]

Weakness enumeration for CVE-2014-8169

OS Trackers for CVE-2014-8169

vendor priority summary link
debian not yet assigned CVE-2014-8169 not yet assigned priority: Debian including 1 source packages (autofs), 4 status rows across 4 suites (bookworm, bullseye, sid, trixie): resolved 4. https://security-tracker.debian.org/tracker/CVE-2014-8169
redhat medium — https://access.redhat.com/security/cve/CVE-2014-8169
suse medium CVE-2014-8169 severity moderate: SUSE including 247 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 261 product×package rows across 31 product lines (SUSE Liberty Linux 7, SUSE Linux Enterprise Desktop 12, … (31 product lines)): Known Affected 231, Fixed 30. https://www.suse.com/security/cve/CVE-2014-8169/
ubuntu medium CVE-2014-8169 medium priority: Ubuntu including 2 source packages (autofs, autofs5), 12 status rows across 6 suites (lucid, precise, trusty, upstream, utopic, vivid): DNE 5, not-affected 3, needed 2, released 2. https://ubuntu.com/security/CVE-2014-8169

Affected software / configurations for CVE-2014-8169

Vendor Product Version Raw CPE
redhat enterprise_linux_desktop 6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node 6.0 cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
automount_project automount 5.0.8 cpe:2.3:a:automount_project:automount:5.0.8:*:*:*:*:*:*:*
opensuse opensuse 13.1 cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
opensuse opensuse 13.2 cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

References for CVE-2014-8169

cvelogic Threat Intelligence