CVE-2018-14417: SoftNAS Cloud web console snserv command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution as root with public exploit code and very high EPSS makes this an urgent patch.

What it is

SoftNAS Cloud before 4.0.3 fails to sanitize the 'recentVersion' parameter in the snserv endpoint of its web administration console, allowing OS command injection. Because the endpoint is reachable without authentication and commands run as root, this is a full compromise of the storage appliance.

Impact

An unauthenticated attacker can execute arbitrary commands with root privileges on the SoftNAS appliance, gaining complete control of the system and any data it stores or manages.

Attack surface

Reachable over the network through the web administration console's snserv endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description confirm no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.896, 99.8th percentile) and multiple references are tagged Exploit, including Exploit-DB 45097 and a Core Security advisory, indicating public exploit code exists.

What to do

• Upgrade SoftNAS Cloud to 4.0.3 or later per the vendor release notes.
• If patching is delayed, restrict network access to the web administration console to trusted management networks only.
• Do not expose the SoftNAS admin interface directly to the internet; place it behind a VPN or jump host.
• Audit the appliance for signs of prior compromise and rotate credentials and keys stored on it.
• Monitor vendor advisories for any follow-up fixes to the snserv endpoint.

Detection

• Inspect web server and appliance logs for requests to the snserv endpoint with suspicious or shell-metacharacter-laden 'recentVersion' values.
• Alert on unexpected child processes spawned by the web server or snserv, especially shells running as root.
• Monitor for outbound connections or command-and-control traffic originating from the SoftNAS appliance.
• Review file integrity and cron/systemd changes on the appliance for persistence artifacts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.