ByteOS Network

NVD Vulnerability Details :

CVE-2018-18471

Analyzed

Source-cve@mitre.org

Published At-19 Jun, 2019 | 16:15

Updated At-14 Feb, 2024 | 01:17

/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

axentra>>hipserv>>-

cpe:2.3:o:axentra:hipserv:-:*:*:*:*:*:*:*

medion>>lifecloud>>-

cpe:2.3:h:medion:lifecloud:-:*:*:*:*:*:*:*

NETGEAR, Inc.

>>stora>>-

cpe:2.3:h:netgear:stora:-:*:*:*:*:*:*:*

seagate>>goflex_home>>-

cpe:2.3:h:seagate:goflex_home:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-611	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.axentra.com/en/	cve@mitre.org	Vendor Advisory URL Repurposed
https://www.wizcase.com/blog/hack-2018/	cve@mitre.org	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History