CVE Details for CVE: CVE-2015-2876
Summary
Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.
| Timestamps | |
|---|---|
| Last major update | 31-12-2015 - 15:46 |
| Published | 31-12-2015 - 05:59 |
| Last modified | 31-12-2015 - 15:46 |
Vulnerable Configurations
-
cpe:2.3:h:lacie:lac9000436u:*:*:*:*:*:*:*:*
cpe:2.3:h:lacie:lac9000436u:*:*:*:*:*:*:*:*
-
cpe:2.3:h:lacie:lac9000464u:*:*:*:*:*:*:*:*
cpe:2.3:h:lacie:lac9000464u:*:*:*:*:*:*:*:*
-
cpe:2.3:o:lacie:lac9000436u_firmware:2.3.0.014:*:*:*:*:*:*:*
cpe:2.3:o:lacie:lac9000436u_firmware:2.3.0.014:*:*:*:*:*:*:*
-
cpe:2.3:o:lacie:lac9000464u_firmware:2.3.0.014:*:*:*:*:*:*:*
cpe:2.3:o:lacie:lac9000464u_firmware:2.3.0.014:*:*:*:*:*:*:*
-
cpe:2.3:h:seagate:wireless_plus_mobile_storage:*:*:*:*:*:*:*:*
cpe:2.3:h:seagate:wireless_plus_mobile_storage:*:*:*:*:*:*:*:*
-
cpe:2.3:h:seagate:wireless_mobile_storage:*:*:*:*:*:*:*:*
cpe:2.3:h:seagate:wireless_mobile_storage:*:*:*:*:*:*:*:*
-
cpe:2.3:h:seagate:goflex_sattelite:*:*:*:*:*:*:*:*
cpe:2.3:h:seagate:goflex_sattelite:*:*:*:*:*:*:*:*
CWE
CVSS
Base
8.3
Impact
10.0
Exploitability
6.5
Access
| Vector | Complexity | Authentication |
|---|---|---|
| ADJACENT_NETWORK | LOW | NONE |
Impact
| Confidentiality | Integrity | Availability |
|---|---|---|
| COMPLETE | COMPLETE | COMPLETE |
CVSS3
Base
8.8
Impact
5.9
Exploitability
2.8
Access
| Attack Complexity | Attack vector | Privileges Required | Scope | User Interaction |
|---|---|---|---|---|
| LOW | ADJACENT_NETWORK | NONE | UNCHANGED | NONE |
Impact
| Confidentiality | Integrity | Availability |
|---|---|---|
| HIGH | HIGH | HIGH |