Cpe:2.3:o:drobo:5n2_firmware:4.0.5-13.28.96115:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3odrobo5n2_firmware4.0.5-13.28.96115/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 02:03:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDroboAccess: Remote command injection via username parameter (CVE-2018-14699)https://feed.craftedsignal.io/briefs/2026-10-cve-2018-14699/Sat, 24 Oct 2026 02:03:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2018-14699/An unauthenticated blind command injection vulnerability in the DroboAccess v2.1 enable_user function allows remote attackers to execute arbitrary shell commands via the username parameter.CVE-2018-14699 is a blind command injection vulnerability located within the DroboAccess v2.1 application. The vulnerability resides in the enable_user function, which fails to sanitize user-provided input before passing it to a shell execution routine. This flaw allows unauthenticated remote attackers to execute arbitrary system commands. A proof-of-concept exploit script has been published, demonstrating the ability to drop a reverse shell script on the target and execute it via bash.

Impact

Successful exploitation allows for unauthenticated remote code execution with the privileges of the DroboAccess application, potentially leading to full system compromise of the affected Drobo NAS device.

Recommendation

  • Inventory all Drobo NAS devices and identify those running the vulnerable DroboAccess application version 2.1.
  • Monitor network logs for HTTP requests directed at DroboAccess management endpoints, specifically those targeting the enable_user functionality.
  • Investigate the provided proof-of-concept indicators, such as outbound bash connections or the creation of a 'revshell' file on the filesystem.
  • If the device remains unpatched or if patches are unavailable, isolate the affected NAS devices from public-facing internet access.
]]>highadvisory