Nervoir

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier **Description** A buffer overflow vulnerability in the FTP service could allow remote attackers to execute arbitrary code on NAS devices. **Recommendations** For QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier, consider disabling the FTP service until a patch is available. As a temporary workaround, restrict access to the NAS devices to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier **Description** A buffer overflow issue in the external device function could allow remote attackers to execute arbitrary code on NAS devices. **Recommendations** For QNAP QTS version 4.2.6 build 20171026, update to a version later than 4.2.6 build 20171026 to resolve the issue. For QNAP QTS version 4.3.3.0378 build 20171117, update to a version later than 4.3.3.0378 build 20171117 to resolve the issue. For QNAP QTS version 4.3.4.0387 (Beta 2) build 20171116 and earlier, update to a version later than 4.3.4.0387 (Beta 2) build 20171116 to resolve the issue. As a temporary workaround, consider restricting access to the external device function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions prior to 4.3.4.0387 **Description** A buffer overflow issue in the login function could allow remote attackers to execute arbitrary code on NAS devices. **Recommendations** For QNAP QTS versions prior to 4.3.4.0387, update to a version later than 4.3.4.0387 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier **Description** A buffer overflow issue in the login function could allow remote attackers to execute arbitrary code on NAS devices. **Recommendations** For QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier, consider disabling the login function temporarily until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier **Description** A buffer overflow issue in the password function could allow remote attackers to execute arbitrary code on NAS devices. **Recommendations** For QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier, consider disabling the password change functionality until a patch is available. Restrict access to the `change password` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier **Description** A buffer overflow issue in the password function could allow remote attackers to execute arbitrary code on NAS devices. **Recommendations** For QNAP QTS versions 4.2.6 build 20171026 through 4.3.4.0387 (Beta 2) build 20171116 and earlier, consider disabling the password change functionality until a patch is available. Restrict access to the `change password` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.