CVE-2019-9945 - CVE House
Back to Database
Status published Critical CVE-2019-9945

SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The...

Vulnerability Description

SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid user credentials. If customers have not followed SoftNAS deployment best practices and expose SoftNAS StorageCenter ports directly to the internet, this vulnerability allows an attacker to gain access to the Webadmin interface to create new users or execute arbitrary commands with administrative privileges, compromising both the platform and the data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9945

Credits & Attribution

No credits recorded in the NVD database.

References

More from softnas

View All →
CVE-2018-14417
A command injection vulnerability was found in the web administration...
Critical 9.8

Affected Vendor

Affected Software

cloud
Vulnerable Versions:
4.2.0, 4.2.1

Timeline

Official Publish: March 23rd, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.