Vulnerability Details : CVE-2014-8687

Public exploit exists!
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.
Published 2017-06-08 16:29:00
Updated 2017-06-16 17:40:38
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2014-8687

Exploit prediction scoring system (EPSS) score for CVE-2014-8687

EPSS FAQ
52.11%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2014-8687

  • Seagate Business NAS Unauthenticated Remote Command Execution
    Disclosure Date: 2015-03-01
    First seen: 2020-04-26
    exploit/linux/http/seagate_nas_php_exec_noauth
    Some Seagate Business NAS devices are vulnerable to command execution via a local file include vulnerability hidden in the language parameter of the CodeIgniter session cookie. The vulnerability manifests in the way the language files are included in the code on the

CVSS scores for CVE-2014-8687

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
 NIST
9.8
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2014-8687

References for CVE-2014-8687

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close