CVE-2018-14417

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root permissions.

• CWE-78

• http://seclists.org/fulldisclosure/2018/Jul/85Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/104914Third Party Advisory, VDB Entry
• https://docs.softnas.com/display/SD/Release+NotesVendor Advisory
• https://www.coresecurity.com/advisories/softnas-cloud-os-command-injectionExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45097/Exploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/85Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/104914Third Party Advisory, VDB Entry
• https://docs.softnas.com/display/SD/Release+NotesVendor Advisory
• https://www.coresecurity.com/advisories/softnas-cloud-os-command-injectionExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45097/Exploit, Third Party Advisory, VDB Entry

Published

Aug 4, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14401CopyData in AxmlParser.c in AXML Parser through 2018-01-04 h…
• CVE-2018-14402axmldec 1.2.0 has an out-of-bounds write in the jitana::axml…
• CVE-2018-14403MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles…
• CVE-2018-14404A NULL pointer dereference vulnerability exists in the xpath…6.5
• CVE-2018-1441IBM Application Performance Management - Response Time Monit…6.1
• CVE-2018-14415An issue was discovered in idreamsoft iCMS before 7.0.10. XS…
• CVE-2018-14418In Msvod Cms v10, SQL Injection exists via an images/lists?c…
• CVE-2018-14419MetInfo 6.0.0 allows XSS via a modified name of the navigati…
• CVE-2018-1442IBM Application Performance Management - Response Time Monit…4.3
• CVE-2018-14420MetInfo 6.0.0 allows a CSRF attack to add a user account via…
• CVE-2018-14421SeaCMS v6.61 allows Remote Code execution by placing PHP cod…
• CVE-2018-14422blog/index.php in SansCMS 0.7 has XSS via the q parameter.