What is the CVSS score of CVE-2015-2876?

CVE-2015-2876 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.0%.

Lac9000436U Firmware CVE-2015-2876

HIGH

2015-12-31 cret@cert.org

RCE File Upload Lac9000436U Firmware Lac9000464U Firmware Wireless Mobile Storage Wireless Plus Mobile Storage Goflex Sattelite

8.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 31, 2015 - 05:59 cve.org

HIGH 8.8

DescriptionCVE.org

AnalysisAI

Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session. Affected products include: Lacie Lac9000436U Firmware, Lacie Lac9000464U Firmware, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, Seagate Goflex Sattelite. Version information: before 3.4.1.105.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.