OpenCVE

The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Seagate	Stcg2000300 Stcg2000300 Firmware Stcg3000300 Stcg3000300 Firmware Stcg4000300 Stcg4000300 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:seagate:stcg2000300_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:seagate:stcg2000300:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:seagate:stcg3000300_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:seagate:stcg3000300:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:seagate:stcg4000300_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:seagate:stcg4000300:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://packetstormsecurity.com/files/172590/Seagate-Central-Storage-2015.0916-User-Creation-Command-Execution.html
https://github.com/rapid7/metasploit-framework/pull/12844
https://pentest.blog/advisory-seagate-central-storage-remote-code-execution/
https://www.invictuseurope.com/blog/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-06T00:00:00

Updated: 2024-08-04T09:11:04.853Z

Reserved: 2020-01-09T00:00:00

Link: CVE-2020-6627

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-12-06T15:15:15.730

Modified: 2024-11-21T05:36:03.737

Link: CVE-2020-6627

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:seagate:stcg2000300_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "6D7BEF1A-49DF-4810-AD36-CE44CB80F172", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:seagate:stcg2000300:-:*:*:*:*:*:*:*", "matchCriteriaId": "A3505C7B-58BD-418A-A849-D3DDD3A80A3C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:seagate:stcg3000300_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B9F51E71-0E42-4B3E-9DF8-0562F5FC38D1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:seagate:stcg3000300:-:*:*:*:*:*:*:*", "matchCriteriaId": "B1213F4F-D977-4580-BC1F-0B6C1E0F116D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:seagate:stcg4000300_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DFB3498C-F70D-41F0-B979-5199E16A2EC2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:seagate:stcg4000300:-:*:*:*:*:*:*:*", "matchCriteriaId": "E51FEA1C-BC27-40AB-A599-06F42F220868", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the \"start\" state and sending a check_device_name request."}, {"lang": "es", "value": "La aplicaci\u00f3n de administraci\u00f3n web en los dispositivos Seagate Central NAS STCG2000300, STCG3000300 y STCG4000300 permite la inyecci\u00f3n de comandos del Sistema Operativo a trav\u00e9s de mv_backend_launch en cirrus/application/helpers/mv_backend_helper.php aprovechando el estado de \"inicio\" y enviando una solicitud check_device_name."}], "id": "CVE-2020-6627", "lastModified": "2024-11-21T05:36:03.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-12-06T15:15:15.730", "references": [{"source": "cve@mitre.org", "url": "http://packetstormsecurity.com/files/172590/Seagate-Central-Storage-2015.0916-User-Creation-Command-Execution.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/rapid7/metasploit-framework/pull/12844"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://pentest.blog/advisory-seagate-central-storage-remote-code-execution/"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://www.invictuseurope.com/blog/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://packetstormsecurity.com/files/172590/Seagate-Central-Storage-2015.0916-User-Creation-Command-Execution.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/rapid7/metasploit-framework/pull/12844"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://pentest.blog/advisory-seagate-central-storage-remote-code-execution/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://www.invictuseurope.com/blog/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}