CVE-2018-14705 Lack of Authentication/Authorization on Administrative Web Pages
CriticalCVSS 9.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these applications, but also poses severe risks to the confidentiality and integrity of data stored within the applications and the device itself.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drobo 5n2 firmware | = 4.0.5 | No fix listed |
References
- blog.securityevaluators.com third-party-advisory
- www.ise.io third-party-advisory