PT-2017-2763 · Qnap · Qnap Ts212P+1

Published 2017-08-18 · Updated 2019-10-03 · CVE-2017-12582

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP TS212P firmware 4.2.1 build 20160601

Description The issue concerns the Surveillance Station component in QNAP TS212P devices, where an unprivileged user can access all functions. Although the unprivileged user cannot log in through the front end, they can still access all functions in the Surveillance Station using their SID. This is related to insufficient access control to the device's functional capabilities, which could allow a remote attacker to gain unauthorized access and execute arbitrary commands.

Recommendations For QNAP TS212P firmware 4.2.1 build 20160601, consider restricting access to the Surveillance Station component until a fix is available. As a temporary workaround, limit the use of unprivileged user accounts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

CWE-264

Related Identifiers

BDU:2017-02012

CVE-2017-12582

Affected Products

Qnap Ts212P

Surveillance Station

References · 4

• https://bdu.fstec.ru/vul/2017-02012 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12582 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12582 · Vendor Advisory
• http://kth.ninja/2017/08/qnap-surveillance-station.html · Note