CVE-2017-17029

CVE-2017-17029 describes a buffer overflow in the login function of QNAP QTS (affected builds include 4.2.6/20171026, 4.3.3/20171117, 4.3.4 Beta2/20171116 and earlier). The root cause is improper handling of user input during login, enabling remote attackers to execute arbitrary code on affected ...

CVE-2017-17032

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17032

CVE-2017-17032 affects QNAP QTS: a buffer overflow in the password handling function (versions including 4.2.6 20171026, 4.3.3.0378 20171117, 4.3.4.0387 Beta 2 20171116 and earlier) allows remote code execution. Multiple connected sources confirm the flaw enables remote attackers to run code with...

CVE-2017-17030

CVE-2017-17030 is a buffer overflow in QNAP QTS login/authLogin.cgi that can allow remote code execution. Affected: QTS 4.2.6 (build 20171026), 4.3.3.0378 (build 20171117), 4.3.4.0387 (Beta 2, build 20171116) and earlier. Root cause: improper handling during parsing of the Host header leading to ...

CVE-2017-17031

CVE-2017-17031 affects QNAP QTS. A pre-auth, remote code execution flaw exists due to a stack-based buffer overflow in the change_password.cgi path, caused by improper handling of the OLD_PASSWORD parameter. Affected are QTS 4.2.6 (build 20171026), 4.3.3.0378 (build 20171117), 4.3.4.0387 Beta 2 (...

CVE-2017-17033

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17033

QNAP QTS CVE-2017-17033 is a stack-based buffer overflow in the password handling of QTS web interfaces (authLogin.cgi/sysinfoReq.cgi). The root cause is lack of bounds checking when the lang parameter is processed in handle_qpkg(), allowing an attacker to overflow a fixed-size stack buffer and e...

CVE-2017-17029

A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the OLDPASSWORD parameter provided to the changepassword.cgi endpoint. The...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37610)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Web devRequest Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within devRequest.cgi. When parsing the password parameter, the process does not properly validate t...

QNAP QTS authLogin Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within authLogin.cgi. When parsing the X-Forwarded-For header, the process does not properly validat...

QNAP QTS authLogin Host Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within authLogin.cgi. When parsing the Host header, the process does not properly validate the lengt...

QNAP QTS NASFTPD USER Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS NASFTPD. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NASFTPD service, which listens on TCP port 21 by default. When parsing the USER...

QNAP QTS Web sysinfoReq Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the lang parameter provided to the sysinfoReq.cgi endpoint. The issue results...

QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the USERNAME parameter provided to the changepassword.cgi endpoint. The issue...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37606)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37607)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Unauthenticated Remote Code Execution(CVE-2017-17033)

Vulnerability Summary The following advisory describes a memory corruption vulnerability that can lead to an unauthenticated remote code execution in QNAP QTS versions 4.3.x and 4.2.x, including the 4.3.3.0299. QNAP Systems, Inc. “specializes in providing networked solutions for file sharing,...

QNAP QTS 4.2.x < 4.2.6 build 20170905, 4.3.x < 4.3.3 build 20170727 Command Injection Vulnerability

QNAP QTS is vulnerable to a command injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...