Description
A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1040018
Issue Tracking, Vendor Advisory x_refsource_confirm
https://www.qnap.com/zh-tw/security-advisory/nas-201712-15
Scores
CVSS v3
9.8
EPSS
0.0324
EPSS Percentile
87.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-119
Status
published
Products (7)
qnap/qts
4.3.4.0358 beta1
qnap/qts
4.3.4.0370 beta1
qnap/qts
4.3.4.0372 beta1
qnap/qts
4.3.4.0374 beta1
qnap/qts
4.3.4.0387 beta2
qnap/qts
< 4.3.3.0378
QNAP/QTS Login function
4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier
Published
Dec 21, 2017
Tracked Since
Feb 18, 2026