QNAP Vulnerabilities and Affected Products
Vulnerabilities associated with QNAP Media Streaming Add-On.
Products
Clear product- qts38 vulnerabilities
- quts_hero27 vulnerabilities
- Photo Station8 vulnerabilities
- qutscloud8 vulnerabilities
- Q'center Virtual Appliance7 vulnerabilities
- QNAP Network-Attached Storage (NAS)5 vulnerabilities
- Network Attached Storage (NAS)4 vulnerabilities
- notes_station_34 vulnerabilities
- QNAP Media Streaming Add-On4 vulnerabilities
- QNAP QTS4 vulnerabilities
- media_streaming_add-on3 vulnerabilities
- qurouter3 vulnerabilities
- Helpdesk2 vulnerabilities
- malware_remover2 vulnerabilities
- music_station2 vulnerabilities
- QTS Login function2 vulnerabilities
- QTS Password function2 vulnerabilities
- qufirewall2 vulnerabilities
- ai_core1 vulnerability
- App Center in QTS1 vulnerability
- container_station1 vulnerability
- hbs_31 vulnerability
- Helpdesk in QTS1 vulnerability
- iartist_lite1 vulnerability
- LDAP Server in QTS1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2017-7640CRITICAL | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges. CWE-78Mar 8, 2018 | CVSS9.8v3.0 | EPSS2.33% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-7641HIGH | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. CWE-352Mar 8, 2018 | CVSS8.8v3.0 | EPSS0.46% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-7634MEDIUM | Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page. CWE-79Mar 8, 2018 | CVSS6.1v3.0 | EPSS0.772% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-7638MEDIUM | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS. CWE-287Mar 8, 2018 | CVSS6.5v3.0 | EPSS0.683% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |