{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/droboaccess-v2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:drobo:droboaccess:2.1:*:*:*:*:*:*:*","cpe:2.3:o:drobo:5n2_firmware:4.0.5-13.28.96115:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2018-14699"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DroboAccess (v2.1)","Drobo 5n2 Firmware (4.0.5-13.28.96115)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Drobo"],"content_html":"\u003cp\u003eCVE-2018-14699 is a blind command injection vulnerability located within the DroboAccess v2.1 application. The vulnerability resides in the enable_user function, which fails to sanitize user-provided input before passing it to a shell execution routine. This flaw allows unauthenticated remote attackers to execute arbitrary system commands. A proof-of-concept exploit script has been published, demonstrating the ability to drop a reverse shell script on the target and execute it via bash.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution with the privileges of the DroboAccess application, potentially leading to full system compromise of the affected Drobo NAS device.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Drobo NAS devices and identify those running the vulnerable DroboAccess application version 2.1.\u003c/li\u003e\n\u003cli\u003eMonitor network logs for HTTP requests directed at DroboAccess management endpoints, specifically those targeting the enable_user functionality.\u003c/li\u003e\n\u003cli\u003eInvestigate the provided proof-of-concept indicators, such as outbound bash connections or the creation of a 'revshell' file on the filesystem.\u003c/li\u003e\n\u003cli\u003eIf the device remains unpatched or if patches are unavailable, isolate the affected NAS devices from public-facing internet access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T02:03:09Z","date_published":"2026-10-24T02:03:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2018-14699/","summary":"An unauthenticated blind command injection vulnerability in the DroboAccess v2.1 enable_user function allows remote attackers to execute arbitrary shell commands via the username parameter.","title":"DroboAccess: Remote command injection via username parameter (CVE-2018-14699)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2018-14699/"}],"language":"en","title":"CraftedSignal Threat Feed - DroboAccess (V2.1)","version":"https://jsonfeed.org/version/1.1"}