PT-2014-2000 · Seagate · Seagate Blackarmor Nas

Publicado 2014-05-03 · Atualizado 2018-03-19 · CVE-2014-3206

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Seagate BlackArmor NAS (affected versions not specified)

Description The issue is related to insufficient input validation in the localJob.php and pre connect check.php scripts of the Seagate BlackArmor NAS web interface. This can be exploited by a remote attacker to execute arbitrary code using the session and auth name parameters. The vulnerable API endpoints are "/backupmgt/localJob.php" and "/backupmgmt/pre connect check.php".

Recommendations For Seagate BlackArmor NAS, consider disabling access to the /backupmgt/localJob.php and /backupmgmt/pre connect check.php scripts until a patch is available. Restrict the use of the session and auth name parameters in the affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2018-00626

CVE-2014-3206

Produtos afetados

Seagate Blackarmor Nas

Referências · 3

• 🔥 https://exploit-db.com/exploits/33159 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3206 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00626 · Nota de Segurança