CVE-2018-12295

9.8 criticalEPSS 1.1%

Critical (9.8) in seagate nas os. EPSS 1.1% chance of exploitation in the next 30 days.

SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2019-05-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

seagate:nas_os

References

https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170

Check your stack JSON