CVE-2017-13067 - CVE House
Back to Database
Status published Critical CVE-2017-13067

QNAP has patched a remote code execution vulnerability affecting the...

Vulnerability Description

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-13067

Credits & Attribution

No credits recorded in the NVD database.

References

More from QNAP

View All →
CVE-2018-14749
Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4...
Critical 9.8
CVE-2018-14748
Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4...
High 7.5
CVE-2018-14747
NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS...
High 7.5
CVE-2018-14746
Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4...
Critical 9.8
CVE-2018-0724
Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and...
Medium 6.1

Affected Vendor

Affected Software

QTS Media Libary PRODUCT
Vulnerable Versions:
prior to 4.2.6 build 20170905, prior to 4.3.3.0299 build 20170901

Timeline

Official Publish: September 14th, 2017
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.