Seagate NAS backupmgt Command Injection for 2026-10-19
Last Updated: 00:00 UTC
Unauthenticated OS command injection via the session parameter of /backupmgt/localJob.php on Seagate Personal Cloud NAS devices. The session=fail trigger bypasses authentication before reaching the vulnerable exec() call.
MITRE ATT&CK
Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application
Observed URIs
Attackers by Country
| Sweden | 3 | 37.5% |
| United States | 2 | 25.0% |
| India | 1 | 12.5% |
| France | 1 | 12.5% |
| Ukraine | 1 | 12.5% |
IP Address : ASN : City/Provider
-
14.102.107.221 : AS18002 AS Number for Interdomain Routing : India
-
185.205.246.47 : AS51167 Contabo GmbH : Lauterbourg
-
198.167.197.162 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.194 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.204 : AS39287 Materialism s.r.l. : Sweden
-
23.241.155.155 : AS20001 Charter Communications Inc : Fontana
-
40.112.199.70 : AS8075 Microsoft Corporation : San Jose
-
94.231.182.96 : AS49183 Galichina Telekommunication LTD : Berezhany