Lucene search

MitreCVE-2018-18471

HistoryJun 19, 2019 - 4:15 p.m.

CVE-2018-18471

2019-06-1916:15:10

CWE-611

mitre

web.nvd.nist.gov

axentra

firmware

xxe vulnerability

api

aggregator

xml

netgear stora

seagate goflex home

medion lifecloud

nvd

ssrf

remote command execution

root access

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.011

Percentile

84.5%

JSON

/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.

Affected configurations

Nvd

Node

axentrahipservMatch-

AND

medionlifecloudMatch-

netgearstoraMatch-

seagategoflex_homeMatch-

VendorProductVersionCPE
axentrahipserv-cpe:2.3:o:axentra:hipserv:-:*:*:*:*:*:*:*
medionlifecloud-cpe:2.3:h:medion:lifecloud:-:*:*:*:*:*:*:*
netgearstora-cpe:2.3:h:netgear:stora:-:*:*:*:*:*:*:*
seagategoflex_home-cpe:2.3:h:seagate:goflex_home:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
axentra	hipserv	-	cpe:2.3:o:axentra:hipserv:-:::::::*
medion	lifecloud	-	cpe:2.3:h:medion:lifecloud:-:::::::*
netgear	stora	-	cpe:2.3:h:netgear:stora:-:::::::*
seagate	goflex_home	-	cpe:2.3:h:seagate:goflex_home:-:::::::*

References

www.axentra.com/en/

www.wizcase.com/blog/hack-2018/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.011

Percentile

84.5%

JSON

Related for CVE-2018-18471