← Vulnerability feed

Vulnerability record · CVE-2018-14705 · published 24 February 2020

CVE-2018-14705: Drobo 5n2 firmware improper authentication vulnerability

Drobo · 5n2 Firmware

In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these applications, but also poses severe risks to the confidentiality and integrity of data stored within the applications and the device itself.

9.8 CVSS 3.1 Critical EPSS 1.9% · top 21.7% CWE-287 · Improper authentication
9.8CVSS 3.1 base score, v2 10.0
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these applications, but also poses severe risks to the confidentiality and integrity of data stored within the applications and the device itself.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc Third Party Advisory
https://www.ise.io/casestudies/sohopelessly-broken-2-0/ Third Party Advisory
https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc Third Party Advisory
https://www.ise.io/casestudies/sohopelessly-broken-2-0/ Third Party Advisory

Track CVE-2018-14705 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-14699Drobo 5n2 firmware os command injection vulnerabilitySystem command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to exec…EPSS 29%9.8CVE-2018-14701Drobo 5n2 firmware os command injection vulnerabilitySystem command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to exec…EPSS 20%9.8CVE-2018-14703Drobo 5n2 firmware incorrect permission assignment vulnerabilityIncorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retr…EPSS 1.3%9.8CVE-2018-14706Drobo 5n2 firmware os command injection vulnerabilitySystem command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to e…EPSS 17%9.8CVE-2018-14708Drobo 5n2 firmware improper authentication vulnerabilityAn insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic.EPSS 1.3%9.8CVE-2018-14709Drobo 5n2 firmware improper authentication vulnerabilityIncorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure to…EPSS 1.9%7.5CVE-2018-14695Drobo 5n2 firmware information exposure vulnerabilityIncorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve…EPSS 1.3%7.5CVE-2018-14696Drobo 5n2 firmware information exposure vulnerabilityIncorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2018-14705), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.