CVE-2015-2874
CriticalSummary
Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 have a default password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Risk Assessment
The risk to the organization is the potential for remote control of the devices, which could lead to data loss or unauthorized access to systems.
Recommendation
It is recommended to update the firmware to version 3.4.1.105 or later and to change the default password for the root account to a stronger one.
Other vulnerabilities in Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, LaCie FUEL
See all- CVE-2015-2876High
Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.
- CVE-2015-2875High
An absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.
Original NVD description (English source)
Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 have a default password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.