CVE-2017-13067 QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerabilit...
CriticalCVSS 9.8
EPSS 16.7%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qnap qts | >= 4.2.0, <= 4.2.6 | No fix listed |
| qnap qts | >= 4.3.0, <= 4.3.3.0299 | No fix listed |
| qnap QTS Media Libary PRODUCT | = prior to 4.2.6 build 20170905 | No fix listed |
| qnap QTS Media Libary PRODUCT | = prior to 4.3.3.0299 build 20170901 | No fix listed |
References
- www.qnap.com vendor-advisory