Lucene search

MitreCVE-2020-6627

HistoryDec 06, 2022 - 3:15 p.m.

CVE-2020-6627

2022-12-0615:15:15

CWE-78

mitre

web.nvd.nist.gov

seagate

central nas

stcg2000300

stcg3000300

stcg4000300

web-management application

os command injection

mv_backend_launch

cirrus

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.055

Percentile

93.3%

JSON

The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the “start” state and sending a check_device_name request.

Affected configurations

Nvd

Node

seagatestcg2000300Match-

AND

seagatestcg2000300_firmwareMatch-

Node

seagatestcg3000300Match-

AND

seagatestcg3000300_firmwareMatch-

Node

seagatestcg4000300Match-

AND

seagatestcg4000300_firmwareMatch-

VendorProductVersionCPE
seagatestcg2000300-cpe:2.3:h:seagate:stcg2000300:-:*:*:*:*:*:*:*
seagatestcg2000300_firmware-cpe:2.3:o:seagate:stcg2000300_firmware:-:*:*:*:*:*:*:*
seagatestcg3000300-cpe:2.3:h:seagate:stcg3000300:-:*:*:*:*:*:*:*
seagatestcg3000300_firmware-cpe:2.3:o:seagate:stcg3000300_firmware:-:*:*:*:*:*:*:*
seagatestcg4000300-cpe:2.3:h:seagate:stcg4000300:-:*:*:*:*:*:*:*
seagatestcg4000300_firmware-cpe:2.3:o:seagate:stcg4000300_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
seagate	stcg2000300	-	cpe:2.3:h:seagate:stcg2000300:-:::::::*
seagate	stcg2000300_firmware	-	cpe:2.3:o:seagate:stcg2000300_firmware:-:::::::*
seagate	stcg3000300	-	cpe:2.3:h:seagate:stcg3000300:-:::::::*
seagate	stcg3000300_firmware	-	cpe:2.3:o:seagate:stcg3000300_firmware:-:::::::*
seagate	stcg4000300	-	cpe:2.3:h:seagate:stcg4000300:-:::::::*
seagate	stcg4000300_firmware	-	cpe:2.3:o:seagate:stcg4000300_firmware:-:::::::*