Lucene search

QnapCVE-2018-0721

HistoryNov 27, 2018 - 11:29 p.m.

CVE-2018-0721

2018-11-2723:29:00

CWE-119

CWE-120

qnap

web.nvd.nist.gov

cve-2018-0721

buffer overflow

nas devices

qnap systems inc

qts

security vulnerability

arbitrary code

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.

Affected configurations

Nvd

Node

qnapqtsMatch4.2.6

qnapqtsMatch4.3.3

qnapqtsMatch4.3.4

VendorProductVersionCPE
qnapqts4.2.6cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*
qnapqts4.3.3cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*
qnapqts4.3.4cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qnap	qts	4.2.6	cpe:2.3:o:qnap:qts:4.2.6:::::::*
qnap	qts	4.3.3	cpe:2.3:o:qnap:qts:4.3.3:::::::*
qnap	qts	4.3.4	cpe:2.3:o:qnap:qts:4.3.4:::::::*

CNA Affected

[
  {
    "platforms": [
      "build 20180711"
    ],
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThanOrEqual": "4.2.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "build 20180725"
    ],
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThanOrEqual": "4.3.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "build 20180710"
    ],
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThanOrEqual": "4.3.4",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qnap.com/zh-tw/security-advisory/nas-201809-20

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

Related for CVE-2018-0721