PT-2018-9032 · Qnap · Qnap Qts

Published 2018-06-21 · Updated 2019-10-03 · CVE-2018-0712

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.3.4 build 20180413

Description A command injection issue in the LDAP Server of QNAP QTS could allow remote attackers to execute arbitrary commands or install malware on the NAS.

Recommendations For QNAP QTS versions prior to 4.3.4 build 20180413, update to a version newer than 4.3.4 build 20180413 to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2018-0712

Affected Products

Qnap Qts

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-0712 · Security Note
• https://qnap.com/zh-tw/security-advisory/nas-201806-19 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0712 · Vendor Advisory
• http://securitytracker.com/id/1041141 · Note