MRLG CVE-2014-3931: 2014 Looking Glass Bug Added to KEV

What to do

1. Check web servers for an MRLG install and record its version.
2. Find any setuid fastping binary with find / -name 'fastping*' -perm -4000 2>/dev/null and remove it or clear the setuid bit.
3. Upgrade to MRLG 5.5.0 or replace the looking glass with currently maintained software.
4. Give the looking glass's router accounts the narrowest read-only rights and limit which hosts they can log in from.
5. If an old install was public, rotate the router credentials in its configuration.

How to check if you are affected or compromised

• Look for a setuid fastping binary and for MRLG releases older than 5.5.0.
• Review web server logs for looking-glass ping requests to unusual destinations.
• Check the looking-glass host for unexpected processes, accounts or cron jobs, and router logs for logins from its account outside normal queries.

What happened#

A looking glass is a small web page that ISPs and internet exchanges run so outsiders can ping, traceroute or query BGP from their routers. MRLG (Multi-Router Looking Glass) is a Perl CGI by John Fraizer, first released in 2000. It logs in to routers over Telnet or SSH on the visitor's behalf.

In May 2014, Eurecom researchers Luca Bruno and Mariano Graziano audited open-source looking glasses. They found six bugs in four packages. On July 1, 2014, they warned NANOG about them. The MRLG bug, CVE-2014-3931, was "remote memory corruption in fastping (SUID binary)." fastping was a ping helper bundled with MRLG. Their Internet Bug Bounty report describes the risk as code execution on the looking-glass server, which could be used to read the router credentials stored there. Cisco Talos, where Graziano was interning, shipped Snort rule 31767 as a mitigation. It allows only default ICMP echo-reply payloads, which points to crafted ping replies as the attack path.

Fraizer released MRLG 5.5.0 on September 27, 2014. His announcement said it replaces fastping.c with the host's own ping utility. The CVE record was not published until March 31, 2017. CISA's enrichment scores it CVSS 3.1 9.8.

On July 7, 2025, CISA added it to KEV "based on evidence of active exploitation." It was listed alongside old PHPMailer, Rails and Zimbra bugs, with a July 28 deadline.

Who is affected#

MRLG installations before 5.5.0. Fraizer wrote that MRLG used fastping only "in the outside chance" the router being queried was Zebra/Quagga. He called that "a very minuscule minority of installations." The project page lists users that are mostly ISPs, exchange points and research networks.

Do you really need to act?#

Almost certainly not, unless you operate a network and run MRLG. CISA did not say what evidence led to the 2025 listing. The Hacker News reported "no public reports" of how the bug was being exploited. We found none as of October 23, 2026. The likely real-world exposure is a forgotten looking glass that has not been touched since before 2014 at a small ISP or exchange. There, a compromise can expose router logins. For everyone else, there is nothing to patch.

What to do now#

1. Ask your network team whether any public looking glass runs MRLG, and check its version.
2. Find setuid copies of the helper with find / -name 'fastping*' -perm -4000 2>/dev/null. Remove them, or clear the bit with chmod u-s.
3. Upgrade to MRLG 5.5.0, or move to maintained looking-glass software.
4. Limit the looking glass's router accounts to read-only commands, and only from that host.
5. If an old install was public, rotate the router credentials in its configuration.

How to tell if you were hit#

• On the looking-glass host, look for unexpected processes, accounts, SSH keys or cron jobs.
• Review web server logs for ping queries to destinations you do not recognize.
• Check router AAA or syslog for logins from the looking-glass account that run commands beyond its normal queries.

Timeline#

• Jun 13, 2014 — The researchers file their Internet Bug Bounty report.
• Jul 1, 2014 — Public warning on NANOG lists CVE-2014-3931.
• Sep 11, 2014 — Talos publishes Snort coverage.
• Sep 27, 2014 — MRLG 5.5.0 removes fastping.c.
• Mar 31, 2017 — CVE record published.
• Jul 7, 2025 — CISA adds the CVE to KEV.
• Jul 28, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2014-3931 · KEV 2025-07-07 · fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. MRLG project (John Fraizer, OP-SEC) — MRLG Version 5.5.0 mrlg.op-sec.us
2. John Fraizer — Security Update: Multi-Router Looking Glass (MRLG) version 5.5.0 released (NANOG, Sep 28, 2014) lists.nanog.org
3. Luca Bruno and Mariano Graziano — Heads-up on security aspects of looking-glass deployments (NANOG, Jul 1, 2014) lists.nanog.org
4. HackerOne (Internet Bug Bounty) — Report 16330: Multiple issues in looking-glass software hackerone.com
5. CVE record — CVE-2014-3931 cve.org
6. CISA — Known Exploited Vulnerabilities: CVE-2014-3931 cisa.gov
7. CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Jul 7, 2025) cisa.gov
8. Cisco Talos — Looking Glasses with Bacon blog.talosintelligence.com

Coverage and analysis

1. The Hacker News — CISA Adds Four Critical Vulnerabilities to KEV Catalog thehackernews.com