NetSight
IP …
critical9.8Public exploit code

CVE-2020-6627

The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in ci…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.

Affected products

VendorProductAffected versions
SeagateStcg2000300 Firmware
All versions
SeagateStcg3000300 Firmware
All versions
SeagateStcg4000300 Firmware
All versions

Weakness classification

CWE-78

References