VULNERABILITY INTELLIGENCE

CVE-2018-18471

CVSS score9.8 CRITICAL

EPSS probability7.71%

CISA KEVNot currently listed

Published2019-06-19

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered by anyone who knows the IP address of the affected device.

Weakness classification

CWE-611: Improper Restriction of XML External Entity Reference

Primary references

cve@mitre.org — Vendor Advisory, URL Repurposed
cve@mitre.org — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory, URL Repurposed
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory