PT-2017-2324 · Qnap · Qts

Publicado 2017-06-15 · Atualizado 2020-09-11 · CVE-2017-7876

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.2.6 build 20170517 QTS versions prior to 4.3.3.0174 build 20170503

Description The issue is related to a lack of input sanitization in the QTS operating system, allowing for command injection. This can enable a remote attacker to execute arbitrary commands. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For QTS versions prior to 4.2.6 build 20170517, update to QTS 4.2.6 build 20170517 or later. For QTS versions prior to 4.3.3.0174 build 20170503, update to QTS 4.3.3.0174 build 20170503 or later.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2017-01522

CVE-2017-7876

Produtos afetados

Qts

Referências · 7

• https://qnap.com/en-us/releasenotes · Nota
• https://bdu.fstec.ru/vul/2017-01522 · Nota de Segurança
• https://qnap.com/zh-tw/security-advisory/nas-201707-12 · Nota
• https://osv.dev/vulnerability/CVE-2017-7876 · Aviso do Fabricante
• https://qnap.com/en/release-notes/qts/4.3.3.0174/20170503 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7876 · Nota de Segurança
• https://qnap.com/en/release-notes/qts/4.2.6/20170517 · Nota