CVE-2018-14699

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115

Description The issue concerns system command injection in the "/DroboAccess/enable user" endpoint, allowing unauthenticated attackers to execute system commands. This is achieved via the username URL parameter.

Recommendations For Drobo 5N2 NAS version 4.0.5-13.28.96115, consider disabling access to the "/DroboAccess/enable user" endpoint until a patch is available. As a temporary workaround, restrict the use of the username parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.