CVE-2018-18471

CRITICAL

Axentra Hipserv - XML External Entity Injection in REST Aggregator

Title source: llm
STIX 2.1

Description

/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.

References (2)

Core 2
Core References
Vendor Advisory, URL Repurposed x_refsource_misc
http://www.axentra.com/en/
Exploit, Third Party Advisory x_refsource_misc
https://www.wizcase.com/blog/hack-2018/

Scores

CVSS v3 9.8
EPSS 0.0771
EPSS Percentile 93.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-611
Status published
Products (1)
axentra/hipserv
Published Jun 19, 2019
Tracked Since Feb 18, 2026