Vulnerability Description
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qnap | Qts | >= 4.2.0, <= 4.2.6 |
References
- https://www.qnap.com/zh-hk/releasenotes/Vendor Advisory
- https://www.qnap.com/zh-hk/releasenotes/Vendor Advisory
FAQ
What is CVE-2017-13067?
CVE-2017-13067 is a vulnerability with a CVSS score of 9.8 (CRITICAL). QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerabilit...
How severe is CVE-2017-13067?
CVE-2017-13067 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-13067?
Check the references section above for vendor advisories and patch information. Affected products include: Qnap Qts.