Lucene search

QnapCVE-2017-13069

HistoryOct 06, 2017 - 6:29 p.m.

CVE-2017-13069

2017-10-0618:29:00

CWE-77

qnap

web.nvd.nist.gov

qnap

music station

command injection

vulnerability

cve-2017-13069

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

69.8%

JSON

QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS.

Affected configurations

Nvd

Node

qnapmusic_stationRange≤4.8.6

qnapmusic_stationRange≤5.0.7

VendorProductVersionCPE
qnapmusic_station*cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	music_station	*	cpe:2.3:a:qnap:music_station::::::::

References

www.qnap.com/en/security-advisory/nas-201710-05

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

69.8%

JSON

Related for CVE-2017-13069