Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-2876

Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.

Published

2015-12-31T05:59:04.737

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

6.5

Impact Score

10.0

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Hardware lacie lac9000436u * No
Hardware lacie lac9000464u * No
Operating System lacie lac9000436u_firmware ≤ 2.3.0.014 Yes
Operating System lacie lac9000464u_firmware ≤ 2.3.0.014 Yes
Hardware seagate wireless_mobile_storage * Yes
Hardware seagate wireless_plus_mobile_storage * Yes
Hardware seagate goflex_sattelite * Yes
References