CVE-2018-14706

System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request...

CVE-2018-14706

The vulnerability CVE-2018-14706 affects Drobo 5N2 NAS with DroboPix, endpoint /DroboPix/api/drobopix/demo, on version 4.0.5-13.28.96115. It is a system command injection via a crafted POST payload to that endpoint, allowing an unauthenticated attacker to execute arbitrary commands on the device ...