CVE-2017-13067

Summary of CVE-2017-13067 : A remote code execution flaw in the QNAP QTS Media Library. Affects QTS versions prior to 4.2.6 (build 20170905) and 4.3.3.0299 (build 20170901). The vulnerability enables an unauthenticated attacker to execute commands on a QNAP NAS via a transcoding service listening...

PT-2017-12906

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.2.6 build 20170905 QNAP QTS versions prior to 4.3.3.0299 build 20170901 Description The issue allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does...

CVE-2017-13067: Undefined Security Weakness

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port...

The vulnerability of the Surveillance Station network storage component on QNAP TS212P allows a intruder to gain unauthorized access to the device and execute arbitrary commands.

The vulnerability of the Surveillance Station network storage component of QNAP TS212P is related to deficiencies in access control for device functions. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the device and execute arbitrary commands...

QNAP NAS 'Media Library' Command Execution Vulnerability (NAS-201709-15)

QNAP QTS is prone to a command execution vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

QNAP Transcode Server Command Execution Exploit

This Metasploit module exploits an unauthenticated remote command injection vulnerability in QNAP NAS devices. The transcoding server listens on port 9251 by default and is vulnerable to command injection using the 'rmfile' command. This Metasploit module was tested successfully on a QNAP TS-431...

QNAP Transcode Server Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'QNAP Transcode Server Command Execution', 'Description' = %q This module exploits an unauthenticated remote command injection vulnerability in QN...

QNAP Transcode Server - Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'QNAP Transcode Server Command Execution', 'Description' = %q This module exploits an unauthenticated remote command injection vulnerability in QN...

QNAP TS212P Elevation of Privilege Vulnerability

QNAP TS212P devices are NAS storage devices from QNAP Systems, and the Surveillance Station component is one of the image management components. A security vulnerability exists in the Surveillance Station component of QNAP TS212P devices using firmware version 4.2.1 build 20160601. An attacker ca...

CVE-2017-12582

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station...

Session fixation

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station...

CVE-2017-12582

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station...

CVE-2017-12582

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station...

CVE-2017-12582

The CVE concerns QNAP TS212P devices, specifically the Surveillance Station component on firmware 4.2.1 build 20160601. An unprivileged user can access all functions within Surveillance Station without a frontend login, using that user’s SID. This implies a privilege/access control flaw that expo...

PT-2017-2763

Name of the Vulnerable Software and Affected Versions QNAP TS212P firmware 4.2.1 build 20160601 Description The issue concerns the Surveillance Station component in QNAP TS212P devices, where an unprivileged user can access all functions. Although the unprivileged user cannot log in through the...

CVE-2017-12582: Missing Authorization

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station...

QNAP QTS Multiple Arbitrary Command Execution Vulnerabilities (Aug 2017) - Active Check

QNAP QTS is prone to multiple vulnerabilities. This VT was deprecated since it is a duplicate of QNAP QTS 4.2.4 Build 20170313 Multiple Vulnerabilities - Active Check OID: 1.3.6.1.4.1.25623.1.0.140238 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a...

QNAP Transcode Server Command Execution

This module exploits an unauthenticated remote command injection vulnerability in QNAP NAS devices. The transcoding server listens on port 9251 by default and is vulnerable to command injection using the 'rmfile' command. This module was tested successfully on a QNAP TS-431 with firmware version...

QNAP QTS < 4.2.6 build 20170729, 4.3.x < 4.3.3 build 20170727 Multiple Vulnerabilities

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

QNAP QTS Command Injection Vulnerability (NAS-201707-12)

QNAP QTS is prone to a command injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...