CVE-2018-14417
CRITICAL IN THE WILDSoftNAS Cloud <4.0.3 - Command Injection
Title source: llmDescription
A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root permissions.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Core Security · textwebappsphp
https://www.exploit-db.com/exploits/45097
References (5)
Scores
CVSS v3
9.8
EPSS
0.7113
EPSS Percentile
98.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
InTheWild.io
2018-10-04
CWE
CWE-78
Status
published
Products (1)
softnas/cloud
< 4.0.3
Published
Aug 04, 2018
Tracked Since
Feb 18, 2026