CVE-2018-5347

9.8 criticalEPSS 54%

Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 54% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2018-01-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

seagate:personal_cloud_firmware

References

https://blogs.securiteam.com/index.php/archives/3548
https://www.exploit-db.com/exploits/43659/
https://blogs.securiteam.com/index.php/archives/3548
https://www.exploit-db.com/exploits/43659/

Check your stack JSON