CVE-2018-14705

Lack of Authentication/Authorization on Administrative Web Pages

published February 24, 2020

CVSS
—
EPSS
2%
Percentile
79.0
In the wild
Unconfirmed
What it is

⚠️ A network-accessible device with no locks on its optional apps is a recipe for disaster! Anyone who can connect can control them — just like leaving the front door wide open at home. 🔥 Picture a restaurant where anyone can walk into the kitchen without any checks! That’s the situation here, as all optional applications on the Drobo 5N2 lack authentication, making it frighteningly easy for unauthorized users to wreak havoc. This vulnerability can lead to unauthorized access, manipulation, or even deletion of critical data stored within the applications. Since attackers can control these apps, the integrity and confidentiality of your data are at severe risk — like a thief walking off with your prized family recipes!

Put simply

Picture a restaurant where anyone can walk into the kitchen without any checks! That’s the situation here, as all optional applications on the Drobo 5N2 lack authentication, making it frighteningly easy for unauthorized users to wreak havoc. In Drobo 5N2 version 4.0.5, the optional applications do not verify if users have the right permissions, allowing any network user to interact with these apps freely without any safeguards in place.

What to do

This vulnerability can lead to unauthorized access, manipulation, or even deletion of critical data stored within the applications. Since attackers can control these apps, the integrity and confidentiality of your data are at severe risk — like a thief walking off with your prized family recipes! To limit risks, ensure that your Drobo 5N2 is updated to the latest version. Regularly review network access controls and restrict access to trusted users only. Consider enabling device firewalls for more protection! You've got this! With these steps, you can secure your Drobo and protect your data from unauthorized access! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01853 · 79.0th percentile
Published
2020-02-24T18:16Z
EPSS history
Timeline
  • 24 FEB 18:16Z
    Lack of Authentication/Authorization on Administrative Web Pages
    cvelistv5