QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the OLDPASSWORD parameter provided to the changepassword.cgi endpoint. The...

QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the USERNAME parameter provided to the changepassword.cgi endpoint. The issue...

QNAP QTS Web devRequest Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within devRequest.cgi. When parsing the password parameter, the process does not properly validate t...

QNAP QTS Web sysinfoReq Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the lang parameter provided to the sysinfoReq.cgi endpoint. The issue results...

QNAP QTS NASFTPD USER Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS NASFTPD. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NASFTPD service, which listens on TCP port 21 by default. When parsing the USER...

PT-2017-14674

Name of the Vulnerable Software and Affected Versions QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 Beta 2 build 20171116 and earlier Description A buffer overflow issue in the login function could allow remote attackers to execute arbitrary code on NAS devices. Recommendations For QN...

PT-2017-14677

Name of the Vulnerable Software and Affected Versions QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 Beta 2 build 20171116 and earlier Description A buffer overflow issue in the password function could allow remote attackers to execute arbitrary code on NAS devices. Recommendations For...

PT-2017-14671

Name of the Vulnerable Software and Affected Versions QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 Beta 2 build 20171116 and earlier Description A buffer overflow vulnerability in the FTP service could allow remote attackers to execute arbitrary code on NAS devices. Recommendations F...

PT-2017-14672

Name of the Vulnerable Software and Affected Versions QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 Beta 2 build 20171116 and earlier Description A buffer overflow issue in the external device function could allow remote attackers to execute arbitrary code on NAS devices...

PT-2017-14673

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.3.4.0387 Description A buffer overflow issue in the login function could allow remote attackers to execute arbitrary code on NAS devices. Recommendations For QNAP QTS versions prior to 4.3.4.0387, update to a versi...

PT-2017-14675

Name of the Vulnerable Software and Affected Versions QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 Beta 2 build 20171116 and earlier Description A buffer overflow issue in the password function could allow remote attackers to execute arbitrary code on NAS devices. Recommendations For...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37607)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37605)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37609)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37606)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Unauthenticated Remote Code Execution(CVE-2017-17033)

Vulnerability Summary The following advisory describes a memory corruption vulnerability that can lead to an unauthenticated remote code execution in QNAP QTS versions 4.3.x and 4.2.x, including the 4.3.3.0299. QNAP Systems, Inc. “specializes in providing networked solutions for file sharing,...

QNAP QTS 4.2.x < 4.2.6 build 20170905, 4.3.x < 4.3.3 build 20170727 Command Injection Vulnerability

QNAP QTS is vulnerable to a command injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

QNAP QTS < 4.2.6 build 20171208, 4.3.3.x < 4.3.3.0396 build 20171205, 4.3.4.x < 4.3.4.0411 build 20171208 Multiple Vulnerabilities

QNAP QTS is vulnerable to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

QNAP Qsync for Windows DLL Hijacking Vulnerability

QNAP Qsync for Windows exe is a Windows-based application from QNAP Systems for synchronizing files in a QNAP NAS storage device. A DLL hijacking vulnerability exists in QNAP Qsync for Windows exe versions 4.2.2.0724 and earlier. A remote attacker can exploit this vulnerability to execute arbitra...