Vulnerability · Published Dec 6, 2022 · Assigned by mitre
CVE-2020-6627
Critical 9.8
In plain English
A critical-severity OS command injection in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.7% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)12.7%top 3.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H