CVE-2014-6140

CVE-2014-6140 describes a critical remote code execution vulnerability affecting IBM Tivoli Endpoint Manager Mobile Device Management (MDM) versions prior to 9.0.60100. The flaw stems from the use of a hardcoded, identical secret HMAC token across all customer installations, allowing attackers to craft malicious Ruby objects in cookies to execute arbitrary code on various portals. With a CVSS score of 9.3, this vulnerability is highly severe due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community.