CVE-2020-6627
high-risk
Published 2022-12-06
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
Do I need to act?
!
14.1% chance of exploitation in next 30 days
EPSS score — higher than 86% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (3)
Affected Vendors
References (8)
Broken Link
https://www.invictuseurope.com/blog/
Broken Link
https://www.invictuseurope.com/blog/
53
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
12/34 · Low
Exposure
9/34 · Low