CVE-2015-2875
Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download request during a Wi-Fi session.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 3.17% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- seagate/goflex sattelite · seagate/wireless mobile storage · seagate/wireless plus mobile storage · lacie/lac9000436u firmware · lacie/lac9000464u firmware
- Source
- cret@cert.org
References
- https://www.kb.cert.org/vuls/id/903500Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-9ZGTUHThird Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-A26L3FThird Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/903500Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-9ZGTUHThird Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-A26L3FThird Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.