CVE-2013-6924

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/124688/Seagate-BlackArmor-NAS-sg2000-2000.1331-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64655Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90109Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/124688/Seagate-BlackArmor-NAS-sg2000-2000.1331-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/64655Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90109Third Party Advisory, VDB Entry

Timeline

Published: Oct 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-69258.3The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote attackers to hijack web sessions by predicting a session id CVE-2013-69268.0The integrated HTTPS server in Siemens RuggedCom ROS before 3.12.2 allows remote authenticated users to bypass intended restrictions on admi CVE-2013-69275.5Internet TRiLOGI Server (unknown versions) could allow a local user to bypass security and create a local user account.CVE-2013-69296.5SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via cra CVE-2013-69306.5SQL injection vulnerability in the page-navigation implementation in Cybozu Garoon 2.0.0 through 2.0.6, 2.1.0 through 2.1.3, 2.5.0 through 2 CVE-2013-69316.5SQL injection vulnerability in the API in Cybozu Garoon 3.7.x before 3.7.3 allows remote authenticated users to execute arbitrary SQL comman CVE-2013-69327.6Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used, allows user-assisted remote attackers to execut CVE-2013-69337.5The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Pl CVE-2013-69347.5The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote CVE-2013-69359.3Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the S CVE-2013-69367.5Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletinBoard) allow remote CVE-2013-69376.8Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a long string in the n