CVE-2014-8687

Опубликовано: 08 июн. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.

Ссылки

http://packetstormsecurity.com/files/130585/Seagate-Business-NAS-2014.00319-Remote-Code-Execution.html
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/72831
Third Party Advisory
VDB Entry
https://beyondbinary.io/articles/seagate-nas-rce/
Third Party Advisory
https://www.exploit-db.com/exploits/36202/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/36264/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/130585/Seagate-Business-NAS-2014.00319-Remote-Code-Execution.html
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/72831
Third Party Advisory
VDB Entry
https://beyondbinary.io/articles/seagate-nas-rce/
Third Party Advisory
https://www.exploit-db.com/exploits/36202/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/36264/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:seagate:business_nas_firmware:2014.00319:*:*:*:*:*:*:*

cpe:2.3:h:seagate:business_nas:-:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.49871

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-327

Связанные уязвимости

GHSA-x4wx-5cqv-7fwc

CVSS3: 9.8

github

больше 3 лет назад

BDU:2017-01860

fstec

больше 11 лет назад

Уязвимость встроенного программного обеспечения Business NAS, позволяющая нарушителю выполнить произвольный код