CVE-2017-6360 : QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator priv

QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.

Published 2017-03-23 16:59:01

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-6360

Qnap » QTS
Versions up to, including, (<=) 4.2.4
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

92.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

https://www.qnap.com/en/support/con_show.php?cid=113

Software Update and Security Advisory | QNAP
Mitigation;Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/97072

QNAP QTAP Qualcomm components Multiple Unspecified Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securitytracker.com/id/1038091

QNAP Storage Devices Multiple Flaws Let Remote Users Inject SQL Commands, Steal Cookies, Conduct Cross-Site Scripting and Clickjacking Attacks, Obtain Potentially Sensitive Informaiton, and Execute Ar
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/97059

QNAP QTS Multiple Arbitrary Command Execution Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.exploit-db.com/exploits/41842/

QNAP TVS-663 QTS < 4.2.4 build 20170313 - Command Injection

CVEs referencing this url
https://www.qnap.com/en-us/releasenotes/

Release Notes for QTS - QNAP
Release Notes;Vendor Advisory

CVEs referencing this url

Jump to