CVE-2018-18471 XML external entity in n/a
Remote attackers can achieve root command execution on affected NAS devices via an XXE vulnerability chained with SSRF in the aggregator API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18471?
CVE-2018-18471 is a critical vulnerability in n/a, published on 19 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.
Weakness: CWE-611
Which versions are affected by CVE-2018-18471?
It affects 1 product.
Products include Axentra Hipserv.
How do I fix CVE-2018-18471?
No fix has been published for CVE-2018-18471 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-18471 being exploited?
There is no known exploitation of CVE-2018-18471 in the wild and no public exploit code.
Sources
Also known as GHSA-vv88-7w5x-843v.