Drobo manufactures network-attached storage appliances, particularly its 5N2 line, which serve as centralized data repositories for small to medium-sized deployments. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and recur through a consistent set of web-interface and system-command weakness classes—information disclosure, authentication bypass, cross-site scripting, OS command injection, and path traversal—that are characteristic of embedded storage management interfaces. Defenders should treat firmware updates for these appliances as high-priority given the severity tendency and the sensitive data these devices typically hold; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Drobo over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-14699CRITICAL System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "us | Dec 3, 2018 | 9.8 | 45 | NO | NO |
CVE-2018-14701CRITICAL System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "us | Dec 3, 2018 | 9.8 | 41 | NO | NO |
CVE-2018-14706CRITICAL System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the | Dec 3, 2018 | 9.8 | 38 | NO | NO |
CVE-2018-14707HIGH Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations. | Dec 3, 2018 | 7.5 | 37 | NO | NO |
CVE-2018-14709CRITICAL Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation. | Dec 3, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-14705CRITICAL In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may i | Feb 24, 2020 | 9.8 | 29 | NO | NO |
CVE-2018-14708CRITICAL An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic. | Dec 3, 2018 | 9.8 | 29 | NO | NO |
CVE-2018-14703CRITICAL Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root pa | Dec 3, 2018 | 9.8 | 29 | NO | NO |
CVE-2018-14702HIGH Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system informatio | Dec 3, 2018 | 7.5 | 24 | NO | NO |
CVE-2018-14700HIGH Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "nam | Dec 3, 2018 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Drobo.
Media articles that mention a CVE ID that affects a product developed by Drobo — matched by CVE ID, not by vendor name.