Lucene search

QnapCVE-2017-13071

HistoryNov 22, 2017 - 5:29 p.m.

CVE-2017-13071

2017-11-2217:29:00

CWE-77

qnap

web.nvd.nist.gov

qnap

video station

remote command execution

vulnerability

patched

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.005

Percentile

77.4%

JSON

QNAP has already patched this vulnerability. This security concern allows a remote attacker to run arbitrary commands on the QNAP Video Station 5.1.3 (for QTS 4.3.3), 5.2.0 (for QTS 4.3.4), and earlier.

Affected configurations

Nvd

Node

qnapvideo_stationMatch5.1.3

AND

qnapqtsMatch4.3.3

Node

qnapvideo_stationMatch5.2.0

AND

qnapqtsMatch4.3.4

VendorProductVersionCPE
qnapvideo_station5.1.3cpe:2.3:a:qnap:video_station:5.1.3:*:*:*:*:*:*:*
qnapqts4.3.3cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*
qnapvideo_station5.2.0cpe:2.3:a:qnap:video_station:5.2.0:*:*:*:*:*:*:*
qnapqts4.3.4cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	video_station	5.1.3	cpe:2.3:a:qnap:video_station:5.1.3:::::::*
qnap	qts	4.3.3	cpe:2.3:o:qnap:qts:4.3.3:::::::*
qnap	video_station	5.2.0	cpe:2.3:a:qnap:video_station:5.2.0:::::::*
qnap	qts	4.3.4	cpe:2.3:o:qnap:qts:4.3.4:::::::*

CNA Affected

[
  {
    "product": "Video Station",
    "vendor": "QNAP",
    "versions": [
      {
        "status": "affected",
        "version": "Video Station 5.1.3 (for QTS 4.3.3), 5. 2.0 (for QTS 4.3.4), and earlier"
      }
    ]
  }
]

References

www.qnap.com/zh-tw/security-advisory/nas-201711-21

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.005

Percentile

77.4%

JSON

Related for CVE-2017-13071