CVE-2017-13067

2017-09-0100:00:00

qnap

www.cve.org

9.8 High

AI Score

Confidence

High

0.016 Low

EPSS

Percentile

87.4%

JSON

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.

CNA Affected

[
  {
    "product": "QTS Media Libary PRODUCT",
    "vendor": "QNAP",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 4.2.6 build 20170905"
      },
      {
        "status": "affected",
        "version": "prior to 4.3.3.0299 build 20170901"
      }
    ]
  }
]

References

www.qnap.com/zh-hk/releasenotes/