PT-2017-2324 · Qnap · Qts

Published 2017-06-15 · Updated 2020-09-11 · CVE-2017-7876

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.2.6 build 20170517 QTS versions prior to 4.3.3.0174 build 20170503

Description The issue is related to a lack of input sanitization in the QTS operating system, allowing for command injection. This can enable a remote attacker to execute arbitrary commands. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For QTS versions prior to 4.2.6 build 20170517, update to QTS 4.2.6 build 20170517 or later. For QTS versions prior to 4.3.3.0174 build 20170503, update to QTS 4.3.3.0174 build 20170503 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2017-01522

CVE-2017-7876

Affected Products

Qts

References · 7

• https://bdu.fstec.ru/vul/2017-01522 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7876 · Security Note
• https://qnap.com/en-us/releasenotes · Note
• https://qnap.com/zh-tw/security-advisory/nas-201707-12 · Note
• https://qnap.com/en/release-notes/qts/4.3.3.0174/20170503 · Note
• https://qnap.com/en/release-notes/qts/4.2.6/20170517 · Note