9.8

CVE-2018-0730

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Qnap ≫ Qts Version 4.2.6
Qnap ≫ Qts Version 4.3.3.0868
Qnap ≫ Qts Version 4.3.3.0998
Qnap ≫ Qts Version 4.3.4.0899
Qnap ≫ Qts Version 4.3.4.1029
Qnap ≫ Qts Version 4.3.6.0895
Qnap ≫ Qts Version 4.3.6.0907
Qnap ≫ Qts Version 4.3.6.0923
Qnap ≫ Qts Version 4.3.6.0944
Qnap ≫ Qts Version 4.3.6.0959
Qnap ≫ Qts Version 4.3.6.0979
Qnap ≫ Qts Version 4.3.6.0993
Qnap ≫ Qts Version 4.3.6.1013
Qnap ≫ Qts Version 4.3.6.1033
Qnap ≫ Qts Version 4.4.1.0948 Update beta
Qnap ≫ Qts Version 4.4.1.0949 Update beta
Qnap ≫ Qts Version 4.4.1.0978 Update beta_2
Qnap ≫ Qts Version 4.4.1.0998 Update beta_3
Qnap ≫ Qts Version 4.4.1.0999 Update beta_3
Qnap ≫ Qts Version 4.4.1.1031 Update beta_4
Qnap ≫ Qts Version 4.4.1.1033 Update beta_4
Qnap ≫ Qts Version 4.4.1.1064
Qnap ≫ Qts Version 4.4.1.1081
Qnap ≫ Qts Version 4.4.1.1086
Qnap ≫ Qts Version 4.4.1.1101
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.96% 0.777
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
Vendor Advisory