cve-2024-27130-poc

CVE-2024-27130-poc CVE-2024-27130是影响QNAP网络附加存储（NAS）设备的一个严重漏洞。该漏洞源于QTS操作系统中share.cgi脚本的NoSupportACL函数中不安全地使用strcpy函数，导致堆栈缓冲区溢出。攻击者可以利用此漏洞，通过精心构造的请求在目标系统上执行任意代码，进而完全控制受影响的设备。 该漏洞的危害主要体现在以下方面： 远程代码执行（RCE） ：未经身份验证的攻击者可通过网络远程执行任意代码，导致系统被完全控制。 数据泄露和篡改 ：攻击者可能访问、修改或删除存储在NAS设备上的敏感数据。 服务中断...

The vulnerability in the get_file_size function of the share.cgi file on QTS, QuTS hero, and QuTScloud operating systems, as well as on Qnap network devices, allows a hacker to execute arbitrary code.

The vulnerability of the getfilesize function in the share.cgi file of QTS, QuTS, Hero, and QuTScloud operating systems, as well as QNAP network devices, is related to the possibility of buffer overflow based on a stack-based mechanism. Exploiting this vulnerability allows a remote attacker to...

PT-2023-9122 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.7.2770 build 20240520 QuTS hero versions prior to h5.1.7.2770 build 20240520 Description: The issue is related to a buffer copy without checking the size of the input, which can lead to a stack overflow. This allows...

ASUSTOR ADM Information Disclosure Vulnerability (CNVD-2018-26926)

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An information disclosure vulnerability exists in the share.cgi file in ASUSTOR ADM version 3.1.1, which can be exploited by an attacker to obtain a key with the help of the 'encryptkey' URL parameter...

CVE-2018-12308

Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...

CVE-2018-12308

ASUSTOR ADM 3.1.1 is affected by an information disclosure in share.cgi that allows an attacker to obtain the encryption key via the encrypt_key URL parameter. The root cause is a flaw in how share.cgi handles the key, enabling unauthorized access to the encryption key and potential compromise of...