CVE-2018-12296

This flaw is like leaving a back door slightly open to the office: even without a key (no login), someone can call a specific “information” endpoint and get details about how your NAS is set up. That information alone may not delete files, but it can help an attacker plan the next step more effectively.

This matters if you run Seagate NAS OS, specifically version 4.3.15.1. The risk is focused on situations where an attacker can reach the affected API endpoint from where they can send requests (commonly the internet).
If your NAS management/API is not reachable from the internet (or is strictly limited to trusted internal addresses/VPN), the exposure is much lower.

This is AMBER because there is a known public exploit for the issue, meaning attackers can use it without inventing new methods. Even though this is “only” information exposure, attackers often use that information to move toward bigger compromises.
No official patch details are available from the provided findings, so you should focus on exposure reduction (internet reachability controls) and contact Seagate support for a fix or workaround.