9.8

CVE-2018-0730

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Data is provided by the National Vulnerability Database (NVD)
Qnap ≫ Qts Version4.2.6
Qnap ≫ Qts Version4.3.3.0868
Qnap ≫ Qts Version4.3.3.0998
Qnap ≫ Qts Version4.3.4.0899
Qnap ≫ Qts Version4.3.4.1029
Qnap ≫ Qts Version4.3.6.0895
Qnap ≫ Qts Version4.3.6.0907
Qnap ≫ Qts Version4.3.6.0923
Qnap ≫ Qts Version4.3.6.0944
Qnap ≫ Qts Version4.3.6.0959
Qnap ≫ Qts Version4.3.6.0979
Qnap ≫ Qts Version4.3.6.0993
Qnap ≫ Qts Version4.3.6.1013
Qnap ≫ Qts Version4.3.6.1033
Qnap ≫ Qts Version4.4.1.0948 Updatebeta
Qnap ≫ Qts Version4.4.1.0949 Updatebeta
Qnap ≫ Qts Version4.4.1.0978 Updatebeta_2
Qnap ≫ Qts Version4.4.1.0998 Updatebeta_3
Qnap ≫ Qts Version4.4.1.0999 Updatebeta_3
Qnap ≫ Qts Version4.4.1.1031 Updatebeta_4
Qnap ≫ Qts Version4.4.1.1033 Updatebeta_4
Qnap ≫ Qts Version4.4.1.1064
Qnap ≫ Qts Version4.4.1.1081
Qnap ≫ Qts Version4.4.1.1086
Qnap ≫ Qts Version4.4.1.1101
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.2% 0.777
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.