CVE-2014-3206

CRITICAL EXPLOITED NUCLEI

Seagate BlackArmor NAS - Remote Code Execution via Session or Auth Name Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2014-3206 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Shayan S, laccart. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates multiple remote code execution (RCE) vulnerabilities in Seagate BlackArmor NAS devices, including command injection via unsanitized input in PHP scripts. The PoC includes examples of reverse shell payloads and highlights hardcoded credentials.

Description

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.

Exploits (2)

exploitdb WORKING POC
by Shayan S · textwebappshardware
https://www.exploit-db.com/exploits/33159

This exploit demonstrates multiple remote code execution (RCE) vulnerabilities in Seagate BlackArmor NAS devices, including command injection via unsanitized input in PHP scripts. The PoC includes examples of reverse shell payloads and highlights hardcoded credentials.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Seagate BlackArmor NAS (all versions)
No auth needed
Prerequisites: Network access to the target device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Seagate BlackArmor NAS - Command Injection
CRITICALby gy741

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/33159/

Scores

CVSS v3 9.8
EPSS 0.9200
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2021-09-20
CWE
CWE-20
Status published
Products (2)
seagate/blackarmor_nas_110_firmware
seagate/blackarmor_nas_220_firmware
Published Feb 23, 2018
Tracked Since Feb 18, 2026