Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-2875

Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.

Published

2015-12-31T05:59:03.720

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

6.9

Weaknesses
  • Type: Primary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Hardware seagate goflex_sattelite * Yes
Hardware seagate wireless_mobile_storage * Yes
Hardware seagate wireless_plus_mobile_storage * Yes
Hardware lacie lac9000436u * No
Hardware lacie lac9000464u * No
Operating System lacie lac9000436u_firmware ≤ 2.3.0.014 Yes
Operating System lacie lac9000464u_firmware ≤ 2.3.0.014 Yes
References