CVE-2015-2875
HighSummary
An absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.
Risk Assessment
Attackers may gain access to sensitive data stored on the devices, potentially leading to privacy breaches and security risks for the organization.
Recommendation
It is recommended to update the firmware to version 3.4.1.105 or later to mitigate this vulnerability.
Other vulnerabilities in Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, LaCie FUEL
See all- CVE-2015-2876High
Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.
- CVE-2015-2874Critical
Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 have a default password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Original NVD description (English source)
Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.