PT-2014-2000 · Seagate · Seagate Blackarmor Nas

Published 2014-05-03 · Updated 2018-03-19 · CVE-2014-3206

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Seagate BlackArmor NAS (affected versions not specified)

Description The issue is related to insufficient input validation in the localJob.php and pre connect check.php scripts of the Seagate BlackArmor NAS web interface. This can be exploited by a remote attacker to execute arbitrary code using the session and auth name parameters. The vulnerable API endpoints are "/backupmgt/localJob.php" and "/backupmgmt/pre connect check.php".

Recommendations For Seagate BlackArmor NAS, consider disabling access to the /backupmgt/localJob.php and /backupmgmt/pre connect check.php scripts until a patch is available. Restrict the use of the session and auth name parameters in the affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2018-00626

CVE-2014-3206

Affected Products

Seagate Blackarmor Nas

References · 3

• 🔥 https://exploit-db.com/exploits/33159 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3206 · Security Note
• https://bdu.fstec.ru/vul/2018-00626 · Security Note