{"id":"CVE-2018-5347","aliases":["EUVD-2018-17126","GHSA-vx2p-j4w8-wfw2"],"status":"published","title":"Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the...","description":"Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.54163,"percentile":0.99015,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2018-01-12T01:00:00Z","modified":"2026-06-17T02:00:10Z","exploits":[{"source":"exploitdb","id":"EDB-43659","title":"Seagate Personal Cloud - Multiple Vulnerabilities","type":"remote","platform":"hardware","date":"2018-01-11","url":"https://www.exploit-db.com/exploits/43659"}],"products":[{"vendor":"seagate","product":"personal_cloud_firmware"}],"references":[{"url":"https://www.exploit-db.com/exploits/43659/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://blogs.securiteam.com/index.php/archives/3548","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5347"},{"url":"https://github.com/advisories/GHSA-vx2p-j4w8-wfw2"}],"sources":{"cve":[{"id":"CVE-2018-5347","description":"Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.","status":"published","published":"2018-01-12T01:00:00Z","modified":"2024-08-05T05:33:44.175Z","updated_at":"2026-11-02T14:35:00.948726Z"}],"euvd":[{"id":"EUVD-2018-17126","description":"Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.","status":"published","published":"2018-01-12T01:00:00Z","modified":"2024-08-05T05:33:44Z","updated_at":"2026-11-03T02:40:10.651692Z"}],"ghsa":[{"id":"GHSA-vx2p-j4w8-wfw2","title":"Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the...","description":"Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.","status":"published","published":"2022-05-13T01:52:47Z","modified":"2023-02-02T05:02:16Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:51:23.915291Z"}],"nvd":[{"id":"CVE-2018-5347","description":"Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.","status":"published","published":"2018-01-12T01:29:00.2Z","modified":"2026-06-17T02:00:10.23Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:04:22.309028Z"}]}}