Back
CVE-2015-2876
HIGH
Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2 during a Wi-Fi session.
Published: Dec 31, 2015
Modified: Jun 17, 2026
CVSS Metrics
CVSSv3
Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (5)
| Vendor | Product | Version |
|---|---|---|
| lacie | lac9000436u_firmware | * |
| lacie | lac9000464u_firmware | * |
| seagate | wireless_mobile_storage | * |
| seagate | wireless_plus_mobile_storage | * |
| seagate | goflex_sattelite | * |
GitHub Security Advisory GHSA-4427-hxx6-cmx7
Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile...
References (6)
- https://www.kb.cert.org/vuls/id/903500 Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-A26L3F Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/903500 Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-9ZGTUH Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/GWAN-A26L3F Third Party Advisory, US Government Resource
Risk Scores
CVSS Score
8.8 / 10
EPSS Score
2.77%
Top 14% most likely to be exploited
Threat Score
36 / 100
Data Sources
NVD
EPSS
GitHub