CVE-2018-14417

9.8 criticalEPSS 89%

Critical (9.8) in softnas cloud. EPSS 89% chance of exploitation in the next 30 days.

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root permissions.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 89% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2018-08-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

softnas:cloud

References

http://seclists.org/fulldisclosure/2018/Jul/85
http://www.securityfocus.com/bid/104914
https://docs.softnas.com/display/SD/Release+Notes
https://www.coresecurity.com/advisories/softnas-cloud-os-command-injection
https://www.exploit-db.com/exploits/45097/

Check your stack JSON