CVE-2020-6627

The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300...

9.8 CriticalPublic exploit

The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

12.7%Up 11.7 points since Dec 7, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2020-6627
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2020-6627
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2020-27775 9.8

Record: EUVD-2020-27775
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6q9w-5qvx-ggjm 9.8

The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300...

Record: GHSA-6q9w-5qvx-ggjm
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)	2023-05-25

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-6627 is a critical vulnerability (CVSS 9.8) in Seagate Stcg2000300 Firmware, published December 6, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.7%, the 96th percentile. No source names a fixed version.