Seagate vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-9267 In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current workingHigh 7 · Sep 26, 2025
• CVE-2020-6627 The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirCritical 9.8 · Dec 6, 2022
• CVE-2021-43429 A Denial of Service vulnerability exists in CORTX-S3 Server as of 11/7/2021 via the mempool_destroy method due to a failture to release locks pool->lock.High 7.5 · Apr 7, 2022
• CVE-2018-12301 Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or locaHigh 7.5 · May 13, 2019
• CVE-2018-12298 Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path.High 7.5 · May 13, 2019
• CVE-2018-12296 Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NASHigh 7.5 · May 13, 2019
• CVE-2018-12295 SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.Critical 9.8 · May 13, 2019
• CVE-2017-18263 Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPlaylistPhotos.psp via a parameter named url.High 7.5 · Apr 27, 2018
• CVE-2014-3206 Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameteCritical 9.8 · Feb 23, 2018
• CVE-2014-3205 backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user.Critical 9.8 · Feb 23, 2018
• CVE-2018-5347 Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs Critical 9.8 · Jan 11, 2018
• CVE-2013-6924 Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter Critical 9.8 · Oct 11, 2017
• CVE-2014-8687 Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a staticCritical 9.8 · Jun 8, 2017
• CVE-2015-2875 Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devicesHigh 7.5 · Dec 31, 2015
• CVE-2015-2874 Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 have a deCritical 9.8 · Dec 31, 2015
• CVE-2012-2568 d41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate BlackArmor device allows remote attackers to change the administrator password High 10 · May 25, 2012