CVE-2013-0143

Published: Jun 7, 2013Modified: Apr 29, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string.

Affected (4)

Products: Qnap: Viostor Network Video Recorder, Nas, Surveillance Station Pro

3 products

Viostor Network Video Recorder

Surveillance Station Pro

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Qnap Viostor Network Video Recorder	Version 4.0.3
Qnap Viostor Network Video Recorder	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Qnap Nas	All versions
Qnap Surveillance Station Pro	All versions

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

http://www.kb.cert.org/vuls/id/927644

Source: cret@cert.org

US Government Resource

http://www.kb.cert.org/vuls/id/927644

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

Timeline

No history available yet.