CVE-2018-5347: Seagate Personal Cloud Media Server unauthenticated command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote command injection with a 9.8 CVSS score, public exploit code and very high EPSS makes this an urgent patching priority.

What it is

Seagate Media Server on Seagate Personal Cloud mishandles shell metacharacters in the uploadTelemetry and getLogs functions in views.py, allowing OS command injection through .psp URLs handled by fastcgi.server. The flaw is remotely reachable without authentication and carries a critical CVSS score of 9.8, so any exposed device is at immediate risk of full compromise.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the device, gaining full control of confidentiality, integrity and availability. This can lead to data theft, persistent backdooring or use of the device as a foothold inside the network.

Attack surface

Reached over the network via crafted .psp URLs processed by the fastcgi.server component; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Public exploit code exists in Exploit-DB and a third-party advisory, and EPSS is 0.54163 (98.9th percentile), indicating a high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the vendor firmware update for Seagate Personal Cloud as soon as it is available.
• If no patch exists, isolate the device on a segmented network and block access to the Media Server from untrusted networks.
• Disable or remove the Seagate Media Server service if it is not required.
• Restrict inbound access to the device's web and fastcgi ports to trusted management hosts only.
• Monitor vendor advisories for updated firmware and re-check exposure after patching.

Detection

• Inspect web and fastcgi logs for requests to .psp URLs containing shell metacharacters such as ;, |, &, $() or backticks.
• Alert on unexpected child processes spawned by the Media Server or fastcgi process.
• Monitor for outbound connections from the device to unknown hosts that could indicate command-and-control or data exfiltration.
• Review device logs for anomalous access to uploadTelemetry and getLogs endpoints from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.