CVE-2015-2876
HighSummary
Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to device takeover and access to user data.
Recommendation
It is recommended to update the firmware to version 3.4.1.105 or later to mitigate this vulnerability.
Other vulnerabilities in Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, LaCie FUEL
See all- CVE-2015-2875High
An absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.
- CVE-2015-2874Critical
Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before version 3.4.1.105 have a default password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Original NVD description (English source)
Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.