Vulnerability Details : CVE-2009-3278
The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack.
Products affected by CVE-2009-3278
- cpe:2.3:o:qnap:ts-239_pro_firmware:2.1.7:build0613:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-239_pro_firmware:3.1.0:build0627:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-239_pro_firmware:3.1.1:build0815:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-639_pro_firmware:2.1.7:build0613:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-639_pro_firmware:3.1.0:build0627:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-639_pro_firmware:3.1.1:build0815:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-3278
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-3278
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:C/I:N/A:N |
3.9
|
6.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST | 2024-02-15 |
CWE ids for CVE-2009-3278
-
Assigned by: nvd@nist.gov (Primary)
-
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3278
-
http://www.securityfocus.com/archive/1/506607/100/0/threaded
Broken Link;Third Party Advisory;VDB Entry
-
http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt
Exploit
-
http://www.securityfocus.com/bid/36467
Broken Link;Third Party Advisory;VDB Entry
-
http://secunia.com/advisories/36793
About Secunia Research | FlexeraBroken Link
Jump to