CVE-2018-0730

Published: Dec 4, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Affected (25)

Products: Qnap: Qts

Qnap

1 product

Qts

Configuration A

25 vulnerable

Vulnerable Software	Affected Versions
Qnap Qts	Version 4.2.6
Qnap Qts	Version 4.3.3.0868
Qnap Qts	Version 4.3.3.0998
Qnap Qts	Version 4.3.4.0899
Qnap Qts	Version 4.3.4.1029
Qnap Qts	Version 4.3.6.0895
Qnap Qts	Version 4.3.6.0907
Qnap Qts	Version 4.3.6.0923
Qnap Qts	Version 4.3.6.0944
Qnap Qts	Version 4.3.6.0959
Qnap Qts	Version 4.3.6.0979
Qnap Qts	Version 4.3.6.0993
Qnap Qts	Version 4.3.6.1013
Qnap Qts	Version 4.3.6.1033
Qnap Qts	Version 4.4.1.0948 beta
Qnap Qts	Version 4.4.1.0949 beta
Qnap Qts	Version 4.4.1.0978 beta_2
Qnap Qts	Version 4.4.1.0998 beta_3
Qnap Qts	Version 4.4.1.0999 beta_3
Qnap Qts	Version 4.4.1.1031 beta_4
Qnap Qts	Version 4.4.1.1033 beta_4
Qnap Qts	Version 4.4.1.1064
Qnap Qts	Version 4.4.1.1081
Qnap Qts	Version 4.4.1.1086
Qnap Qts	Version 4.4.1.1101

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

https://www.qnap.com/zh-tw/security-advisory/nas-201911-20

Source: security@qnapsecurity.com.tw

Vendor Advisory

https://www.qnap.com/zh-tw/security-advisory/nas-201911-20

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.