Back to feed
EUVD-2018-1519 · Published Jul 17, 2018
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
Technologies
Qnap Q\'Center
Weaknesses
CWE-78
CVSS scores
- v3.08.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - v2.09.0
AV:N/AC:L/Au:S/C:C/I:C/A:C
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html
- http://seclists.org/fulldisclosure/2018/Jul/45
- https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities
- https://www.exploit-db.com/exploits/45015/
- https://www.securityfocus.com/archive/1/542141/100/0/threaded
- https://www.qnap.com/zh-tw/security-advisory/nas-201807-10
Potentially impacted assets
See if this affects your attack surface
