CVE-2018-14699

critical · 9.8

System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter.

9.8

CVSS

29.4%

EPSS (exploit prob.)

98th

EPSS percentile

2018-12-03

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
drobo	5n2_firmware	4.0.5-13.28.96115
drobo	5n2	all versions

Check a specific version with /api/v1/cve/match.

References

https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-14699