Sign-up

ID

VAR-201512-0526


CVE

CVE-2015-2876


TITLE

Seagate and LaCie wireless storage products contain multiple vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#903500

DESCRIPTION

Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session. Seagate There are multiple vulnerabilities in the wireless storage products offered by. Authentication information ( password ) Is hard-coded (CWE-798) - CVE-2015-2874 Not described in manual telnet Service is up and username "root" , Accessible using the default password. CWE-798: Use of Hard-coded Credentials https://cwe.mitre.org/data/definitions/798.html In addition, National Vulnerability Database (NVD) Then CWE-255 It is published as Send request directly (Forced Browsing) (CWE-425) - CVE-2015-2875 By default, anyone can download files when accessing the device wirelessly. Any file on the file system can be downloaded directly. CWE-425: Direct Request ('Forced Browsing') https://cwe.mitre.org/data/definitions/425.html In addition, National Vulnerability Database (NVD) Then CWE-22 It is published as Unlimited upload of dangerous types of files (CWE-434) - CVE-2015-2876 When accessing the device wirelessly with default settings, /media/sda2 You can upload files to the file system. This file system is prepared for file sharing. CWE-434: Unrestricted Upload of File with Dangerous Type https://cwe.mitre.org/data/definitions/434.htmlA remote attacker can access arbitrary files on the product, root It may be operated with authority. Seagate 36C running firmware versions 2.2.0.005 and 2.3.0.014 are vulnerable

Trust: 2.7

sources: NVD: CVE-2015-2876 // CERT/CC: VU#903500 // JVNDB: JVNDB-2015-006526 // BID: 76547 // VULHUB: VHN-80837

AFFECTED PRODUCTS

vendor:seagatemodel:wireless mobile storagescope: - version: -

Trust: 1.4

vendor:seagatemodel:wireless plus mobile storagescope: - version: -

Trust: 1.4

vendor:seagatemodel:wireless mobile storagescope:eqversion:*

Trust: 1.0

vendor:seagatemodel:goflex sattelitescope:eqversion:*

Trust: 1.0

vendor:laciemodel:lac9000436uscope:lteversion:2.3.0.014

Trust: 1.0

vendor:seagatemodel:wireless plus mobile storagescope:eqversion:*

Trust: 1.0

vendor:laciemodel:lac9000464uscope:lteversion:2.3.0.014

Trust: 1.0

vendor:laciemodel: - scope: - version: -

Trust: 0.8

vendor:seagatemodel: - scope: - version: -

Trust: 0.8

vendor:laciemodel:fuelscope: - version: -

Trust: 0.8

vendor:seagatemodel:goflex satellitescope: - version: -

Trust: 0.8

vendor:seagatemodel:goflex sattelitescope: - version: -

Trust: 0.6

vendor:seagatemodel:technology llc seagate 36cscope:eqversion:2.3.0.014

Trust: 0.3

vendor:seagatemodel:technology llc seagate 36cscope:eqversion:2.2.0.005

Trust: 0.3

vendor:seagatemodel:technology llc seagate 36cscope:neversion:3.4.1.105

Trust: 0.3

sources: CERT/CC: VU#903500 // BID: 76547 // JVNDB: JVNDB-2015-006526 // CNNVD: CNNVD-201509-209 // NVD: CVE-2015-2876

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-2876
value: HIGH

Trust: 1.0

IPA: JVNDB-2015-006526
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201509-209
value: HIGH

Trust: 0.6

VULHUB: VHN-80837
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-2876
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

IPA: JVNDB-2015-006526
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-80837
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-2876
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.0

sources: VULHUB: VHN-80837 // JVNDB: JVNDB-2015-006526 // CNNVD: CNNVD-201509-209 // NVD: CVE-2015-2876

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

problemtype:CWE-22

Trust: 0.8

problemtype:CWE-255

Trust: 0.8

sources: JVNDB: JVNDB-2015-006526 // NVD: CVE-2015-2876

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201509-209

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201509-209

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006526

PATCH
title:Firmware Updates for Seagate Productsurl:http://knowledge.seagate.com/articles/en_US/FAQ/207931en
Trust: 0.8
title:Multiple Seagate Fixes for wireless storage products without restricting file upload vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=57746
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2015-006526 // 
            
            
            
            CNNVD: CNNVD-201509-209

EXTERNAL IDS
db:CERT/CCid:VU#903500
Trust: 3.6
db:NVDid:CVE-2015-2876
Trust: 2.8
db:JVNid:JVNVU92833570
Trust: 0.8
db:JVNDBid:JVNDB-2015-006526
Trust: 0.8
db:CNNVDid:CNNVD-201509-209
Trust: 0.7
db:BIDid:76547
Trust: 0.3
db:VULHUBid:VHN-80837
Trust: 0.1
sources:
            
            
            CERT/CC: VU#903500 // 
            
            
            
            VULHUB: VHN-80837 // 
            
            
            
            BID: 76547 // 
            
            
            
            JVNDB: JVNDB-2015-006526 // 
            
            
            
            CNNVD: CNNVD-201509-209 // 
            
            
            
            NVD: CVE-2015-2876

REFERENCES
url:https://www.kb.cert.org/vuls/id/903500
Trust: 2.8
url:https://www.kb.cert.org/vuls/id/gwan-9zgtuh
Trust: 2.5
url:https://www.kb.cert.org/vuls/id/gwan-a26l3f
Trust: 2.5
url:https://apps1.seagate.com/downloads/request.html
Trust: 1.4
url:http://knowledge.seagate.com/articles/en_us/faq/207931en
Trust: 1.4
url:http://cwe.mitre.org/data/definitions/425.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/434.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/798.html
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2874
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2875
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2876
Trust: 0.8
url:http://jvn.jp/vu/jvnvu92833570/index.html
Trust: 0.8
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2874
Trust: 0.8
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2875
Trust: 0.8
url:https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2876
Trust: 0.8
url:http://www.seagate.com/in/en/
Trust: 0.3
sources:
            
            
            CERT/CC: VU#903500 // 
            
            
            
            VULHUB: VHN-80837 // 
            
            
            
            BID: 76547 // 
            
            
            
            JVNDB: JVNDB-2015-006526 // 
            
            
            
            CNNVD: CNNVD-201509-209 // 
            
            
            
            NVD: CVE-2015-2876

CREDITS
Mike Baucom, Allen Harper, and J. Rach of Tangible Security
Trust: 0.3
sources:
            
            
            BID: 76547

SOURCES
db:CERT/CCid:VU#903500
db:VULHUBid:VHN-80837
db:BIDid:76547
db:JVNDBid:JVNDB-2015-006526
db:CNNVDid:CNNVD-201509-209
db:NVDid:CVE-2015-2876

LAST UPDATE DATE
2025-04-13T21:32:34.288000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#903500date:2015-12-08T00:00:00
db:VULHUBid:VHN-80837date:2015-12-31T00:00:00
db:BIDid:76547date:2015-09-01T00:00:00
db:JVNDBid:JVNDB-2015-006526date:2016-01-14T00:00:00
db:CNNVDid:CNNVD-201509-209date:2016-01-04T00:00:00
db:NVDid:CVE-2015-2876date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CERT/CCid:VU#903500date:2015-09-01T00:00:00
db:VULHUBid:VHN-80837date:2015-12-31T00:00:00
db:BIDid:76547date:2015-09-01T00:00:00
db:JVNDBid:JVNDB-2015-006526date:2015-12-28T00:00:00
db:CNNVDid:CNNVD-201509-209date:2015-09-17T00:00:00
db:NVDid:CVE-2015-2876date:2015-12-31T05:59:04.737