PT-2013-2129 · Qnap · Surveillance Station+2

David Elze + 1 · Publicado 2013-06-07 · Atualizado 2013-06-10 · CVE-2013-0143

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR devices version 4.0.3 QNAP NAS (affected versions not specified), specifically in the Surveillance Station Pro component

Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by leveraging guest access and placing shell metacharacters in the query string of the 'cgi-bin/pingping.cgi' endpoint.

Recommendations For QNAP VioStor NVR devices version 4.0.3, update the firmware to a version that addresses this issue. For QNAP NAS with the Surveillance Station Pro component, restrict access to the 'cgi-bin/pingping.cgi' endpoint until a fix is available. As a temporary workaround, consider disabling guest access to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-0143

Produtos afetados

Qnap Nas

Qnap Viostor Nvr

Surveillance Station

Referências · 3

• 🔥 https://exploit-db.com/exploits/38550 · Exploit
• http://kb.cert.org/vuls/id/927644 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0143 · Nota de Segurança