CVE-2014-5457

2022-10-0316:20:43

mitre

www.cve.org

qnap

firmware

security

vulnerability

world-readable

permissions

hashed passwords

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password.

References

seclists.org/fulldisclosure/2014/Jul/57

seclists.org/fulldisclosure/2014/Jul/58

seclists.org/fulldisclosure/2014/Jul/59

seclists.org/fulldisclosure/2014/Jul/61