Skip to content
Threat Feed
Subscribe
high advisory

DroboAccess: Remote command injection via username parameter (CVE-2018-14699)

An unauthenticated blind command injection vulnerability in the DroboAccess v2.1 enable_user function allows remote attackers to execute arbitrary shell commands via the username parameter.

CVE search metadata

CVE search record: CVE-2018-14699. Severity: critical. CVSS: 9.8. EPSS: 29.40%. KEV: no. Product: DroboAccess (v2.1), Drobo 5n2 Firmware (4.0.5-13.28.96115). Brief: DroboAccess: Remote command injection via username parameter (CVE-2018-14699). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2018-14699/

Triage facts

Revision 1
Applicability
DroboAccess (v2.1), Drobo 5n2 Firmware (4.0.5-13.28.96115)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Oct 24, 02:03 UTC
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2018-14699 is a blind command injection vulnerability located within the DroboAccess v2.1 application. The vulnerability resides in the enable_user function, which fails to sanitize user-provided input before passing it to a shell execution routine. This flaw allows unauthenticated remote attackers to execute arbitrary system commands. A proof-of-concept exploit script has been published, demonstrating the ability to drop a reverse shell script on the target and execute it via bash.

Impact

Successful exploitation allows for unauthenticated remote code execution with the privileges of the DroboAccess application, potentially leading to full system compromise of the affected Drobo NAS device.

Recommendation

  • Inventory all Drobo NAS devices and identify those running the vulnerable DroboAccess application version 2.1.
  • Monitor network logs for HTTP requests directed at DroboAccess management endpoints, specifically those targeting the enable_user functionality.
  • Investigate the provided proof-of-concept indicators, such as outbound bash connections or the creation of a 'revshell' file on the filesystem.
  • If the device remains unpatched or if patches are unavailable, isolate the affected NAS devices from public-facing internet access.

Immediate actions

Isolate internet-facing Drobo NAS devices until patch status is confirmed.

IT Operations 24h

Threat Hunt

Identify outbound network connections initiated by the web server process to unexpected IPs on non-standard ports (e.g., 1337).

T1071.001 high high confidence hunt now

Data: Firewall/IDS logs for outbound traffic from Drobo NAS devices

Search filesystem for files named "revshell" or unauthorized scripts created in the web root or temporary directories.

T1059.004 medium high confidence hunt now

Data: File system integrity monitoring

Mitigations

Restrict network access to DroboAccess management interfaces.

immediate IT Operations

CVE-2018-14699