PT-2018-8417 · Qnap · Media Streaming Add-On

Published 2018-03-08 · Updated 2018-03-27 · CVE-2017-7638

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions QNAP NAS application Media Streaming add-on versions 421.1.0.2, 430.1.2.0, and earlier

Description The issue is related to improper authentication of requests in the Media Streaming add-on. This could allow for unauthorized changes to Media Streaming settings and potentially lead to the leakage of sensitive information from the QNAP NAS.

Recommendations For versions 421.1.0.2, 430.1.2.0, and earlier, update to a version that properly authenticates requests to prevent unauthorized changes and data leakage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-7638

Affected Products

Media Streaming Add-On

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-7638 · Security Note
• https://qnap.com/zh-tw/security-advisory/nas-201803-08 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7638 · Vendor Advisory