Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-18471

/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.

Published

2019-06-19T16:15:10.640

Last Modified

2024-11-21T03:55:59.520

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-611

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	axentra	hipserv	-	Yes
Hardware	medion	lifecloud	-	No
Hardware	netgear	stora	-	No
Hardware	seagate	goflex_home	-	No

References

http://www.axentra.com/en/ Vendor Advisory, URL Repurposed ([email protected])
https://www.wizcase.com/blog/hack-2018/ Exploit, Third Party Advisory ([email protected])
http://www.axentra.com/en/ Vendor Advisory, URL Repurposed (af854a3a-2127-422b-91ae-364da2661108)
https://www.wizcase.com/blog/hack-2018/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)