PT-2018-9026 · Qnap · Qnap Q'Center Virtual Appliance

Ivan Huertas · Published 2018-07-16 · Updated 2019-10-03 · CVE-2018-0706

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP Q'center Virtual Appliance versions 1.7.1063 and earlier

Description Exposure of private information could allow authenticated users to access sensitive information.

Recommendations For QNAP Q'center Virtual Appliance versions 1.7.1063 and earlier, update to a version later than 1.7.1063 to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2018-0706

Affected Products

Qnap Q'Center Virtual Appliance

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb · Exploit
• 🔥 https://securityfocus.com/archive/1/542141/100/0/threaded · Exploit
• 🔥 https://coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/45015 · Exploit
• 🔥 https://exploit-db.com/exploits/45043 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Jul/45 · Exploit
• 🔥 http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html · Exploit
• https://qnap.com/zh-tw/security-advisory/nas-201807-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0706 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0706 · Vendor Advisory