PT-2020-8658 · Qnap Systems · Music Station

Published 2020-11-02 · Updated 2022-11-16 · CVE-2018-19950

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. Music Station versions prior to 5.1.13 QNAP Systems Inc. Music Station versions prior to 5.2.9 QNAP Systems Inc. Music Station versions prior to 5.3.11

Description: This issue is a command injection vulnerability that could allow remote attackers to execute arbitrary commands if exploited.

Recommendations: For versions prior to 5.1.13, update to version 5.1.13 or later. For versions prior to 5.2.9, update to version 5.2.9 or later. For versions prior to 5.3.11, update to version 5.3.11 or later.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2018-19950

Affected Products

Music Station

References · 3

• https://qnap.com/en/security-advisory/qsa-20-10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-19950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19950 · Security Note