PT-2013-2129 · Qnap · Surveillance Station+2

David Elze + 1 · Published 2013-06-07 · Updated 2013-06-10 · CVE-2013-0143

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR devices version 4.0.3 QNAP NAS (affected versions not specified), specifically in the Surveillance Station Pro component

Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by leveraging guest access and placing shell metacharacters in the query string of the 'cgi-bin/pingping.cgi' endpoint.

Recommendations For QNAP VioStor NVR devices version 4.0.3, update the firmware to a version that addresses this issue. For QNAP NAS with the Surveillance Station Pro component, restrict access to the 'cgi-bin/pingping.cgi' endpoint until a fix is available. As a temporary workaround, consider disabling guest access to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-0143

Affected Products

Qnap Nas

Qnap Viostor Nvr

Surveillance Station

References · 3

• 🔥 https://exploit-db.com/exploits/38550 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-0143 · Security Note
• http://kb.cert.org/vuls/id/927644 · Note