CVE-2017-17028

CVE-2017-17028 describes a buffer overflow in QNAP QTS external device function affecting QTS 4.2.6 (build 20171026), 4.3.3.0378 (build 20171117), and 4.3.4.0387 Beta 2 (build 20171116) and earlier. The vulnerability enables remote attackers to execute arbitrary code on NAS devices via network ac...

CVE-2017-17031

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17029

CVE-2017-17029 describes a buffer overflow in the login function of QNAP QTS (affected builds include 4.2.6/20171026, 4.3.3/20171117, 4.3.4 Beta2/20171116 and earlier). The root cause is improper handling of user input during login, enabling remote attackers to execute arbitrary code on affected ...

CVE-2017-17030

A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17028

A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17027

CVE-2017-17027 affects QNAP QTS NASFTPD: a stack-based buffer overflow in the FTP service allows remote code execution. Affected are QTS versions 4.2.6 (build 20171026), 4.3.3.0378 (build 20171117), 4.3.4.0387 Beta2 (build 20171116) and earlier. Root cause per ZDI involves improper validation dur...

CVE-2017-17032

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17031

CVE-2017-17031 affects QNAP QTS. A pre-auth, remote code execution flaw exists due to a stack-based buffer overflow in the change_password.cgi path, caused by improper handling of the OLD_PASSWORD parameter. Affected are QTS 4.2.6 (build 20171026), 4.3.3.0378 (build 20171117), 4.3.4.0387 Beta 2 (...

CVE-2017-17033

QNAP QTS CVE-2017-17033 is a stack-based buffer overflow in the password handling of QTS web interfaces (authLogin.cgi/sysinfoReq.cgi). The root cause is lack of bounds checking when the lang parameter is processed in handle_qpkg(), allowing an attacker to overflow a fixed-size stack buffer and e...

CVE-2017-17030

CVE-2017-17030 is a buffer overflow in QNAP QTS login/authLogin.cgi that can allow remote code execution. Affected: QTS 4.2.6 (build 20171026), 4.3.3.0378 (build 20171117), 4.3.4.0387 (Beta 2, build 20171116) and earlier. Root cause: improper handling during parsing of the Host header leading to ...

CVE-2017-17033

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

CVE-2017-17032

CVE-2017-17032 affects QNAP QTS: a buffer overflow in the password handling function (versions including 4.2.6 20171026, 4.3.3.0378 20171117, 4.3.4.0387 Beta 2 20171116 and earlier) allows remote code execution. Multiple connected sources confirm the flaw enables remote attackers to run code with...

CVE-2017-17029

A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 Beta 2 build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2017-37610)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS. A remote attacker could exploit this vulnerability to execute arbitrary code on th...

QNAP QTS Web devRequest Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within devRequest.cgi. When parsing the password parameter, the process does not properly validate t...

QNAP QTS authLogin Host Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within authLogin.cgi. When parsing the Host header, the process does not properly validate the lengt...

QNAP QTS authLogin Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within authLogin.cgi. When parsing the X-Forwarded-For header, the process does not properly validat...

QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the OLDPASSWORD parameter provided to the changepassword.cgi endpoint. The...

QNAP QTS NASFTPD USER Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS NASFTPD. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NASFTPD service, which listens on TCP port 21 by default. When parsing the USER...

QNAP QTS Web change_password Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of QNAP QTS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the USERNAME parameter provided to the changepassword.cgi endpoint. The issue...