CVE-2018-18471
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.
/api/2.0/rest/aggregator/xml en el firmware Axentra, utilizado por NETGEAR Stora, Seagate GoFlex Home y MEDION LifeCloud, tiene una vulnerabilidad XXE que se puede encadenar con un error SSRF para obtener la ejecución remota de comandos como root. Puede ser activado por cualquiera que conozca la dirección IP del dispositivo afectado.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-10-18 CVE Reserved
- 2019-06-19 CVE Published
- 2023-05-26 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.wizcase.com/blog/hack-2018 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.axentra.com/en | 2024-02-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Axentra Search vendor "Axentra" | Hipserv Search vendor "Axentra" for product "Hipserv" | - | - |
Affected
| in | Medion Search vendor "Medion" | Lifecloud Search vendor "Medion" for product "Lifecloud" | - | - |
Safe
|
| Axentra Search vendor "Axentra" | Hipserv Search vendor "Axentra" for product "Hipserv" | - | - |
Affected
| in | Netgear Search vendor "Netgear" | Stora Search vendor "Netgear" for product "Stora" | - | - |
Safe
|
| Axentra Search vendor "Axentra" | Hipserv Search vendor "Axentra" for product "Hipserv" | - | - |
Affected
| in | Seagate Search vendor "Seagate" | Goflex Home Search vendor "Seagate" for product "Goflex Home" | - | - |
Safe
|