QNAP Vulnerabilities and Affected Products
Vulnerabilities associated with QNAP QTS.
Products
Clear product- qts38 vulnerabilities
- quts_hero27 vulnerabilities
- Photo Station8 vulnerabilities
- qutscloud8 vulnerabilities
- Q'center Virtual Appliance7 vulnerabilities
- QNAP Network-Attached Storage (NAS)5 vulnerabilities
- Network Attached Storage (NAS)4 vulnerabilities
- notes_station_34 vulnerabilities
- QNAP Media Streaming Add-On4 vulnerabilities
- QNAP QTS4 vulnerabilities
- media_streaming_add-on3 vulnerabilities
- qurouter3 vulnerabilities
- Helpdesk2 vulnerabilities
- malware_remover2 vulnerabilities
- music_station2 vulnerabilities
- QTS Login function2 vulnerabilities
- QTS Password function2 vulnerabilities
- qufirewall2 vulnerabilities
- ai_core1 vulnerability
- App Center in QTS1 vulnerability
- container_station1 vulnerability
- hbs_31 vulnerability
- Helpdesk in QTS1 vulnerability
- iartist_lite1 vulnerability
- LDAP Server in QTS1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2018-14747HIGH | NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to crash the NAS media server. CWE-476Nov 28, 2018 | CVSS7.5v3.0 | EPSS1.26% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-14749CRITICAL | Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS. CWE-119Nov 28, 2018 | CVSS9.8v3.0 | EPSS1.19% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-14748HIGH | Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to power off the NAS. CWE-863Nov 28, 2018 | CVSS7.5v3.0 | EPSS1.28% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-14746CRITICAL | Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to run arbitrary commands on the NAS. CWE-77Nov 28, 2018 | CVSS9.8v3.0 | EPSS3.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |