PT-2017-12910 · Qnap · Qnap Video Station+1

李衍龙 + 1 · Published 2017-11-22 · Updated 2017-12-12 · CVE-2017-13071

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP Video Station versions prior to 5.1.3 (for QTS 4.3.3) and 5.2.0 (for QTS 4.3.4)

Description This issue allows a remote attacker to run arbitrary commands.

Recommendations For QNAP Video Station version 5.1.3 (for QTS 4.3.3) and later, no action is required as the issue has been patched. For QNAP Video Station versions prior to 5.1.3 (for QTS 4.3.3) and 5.2.0 (for QTS 4.3.4), update to the latest version to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-13071

Affected Products

Qnap Video Station

Qts

References · 3

• https://osv.dev/vulnerability/CVE-2017-13071 · Vendor Advisory
• https://qnap.com/zh-tw/security-advisory/nas-201711-21 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-13071 · Security Note