Drobo

15 CVEs across 2 Drobo products. Browse Drobo vulnerabilities, severities, and proof-of-concept exploits.

Drobo products with known CVEs

Product	CVEs
5n2	15
5n2 Firmware	15

Drobo CVEs — newest first
CVE	Severity	Score	Published	Summary
`CVE-2018-14705`	Critical	`9.8`	2020-02-24	In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device o…
`CVE-2018-14709`	Critical	`9.8`	2018-12-03	Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token genera…
`CVE-2018-14708`	Critical	`9.8`	2018-12-03	An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic.
`CVE-2018-14707`	High	`7.5`	2018-12-03	Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary l…
`CVE-2018-14706`	Critical	`9.8`	2018-12-03	System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute sys…
`CVE-2018-14704`	Medium	`6.1`	2018-12-03	Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path.
`CVE-2018-14703`	Critical	`9.8`	2018-12-03	Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the M…
`CVE-2018-14702`	High	`7.5`	2018-12-03	Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensit…
`CVE-2018-14701`	Critical	`9.8`	2018-12-03	System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system…
`CVE-2018-14700`	High	`7.5`	2018-12-03	Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL l…
`CVE-2018-14699`	Critical	`9.8`	2018-12-03	System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system…
`CVE-2018-14698`	Medium	`6.1`	2018-12-03	Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "userna…
`CVE-2018-14697`	Medium	`6.1`	2018-12-03	Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the usernam…
`CVE-2018-14696`	High	`7.5`	2018-12-03	Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive…
`CVE-2018-14695`	High	`7.5`	2018-12-03	Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnosti…