⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2017-7876 — Command Injection in Qnap QTS

CWE-77 — Command Injection4 documents4 sources
Severity
10.0CRITICALNVD
EPSS
6.7%
top 8.73%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Qnap QTS
Timeline
PublishedJun 15
Latest updateMay 13

Description

This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS 4.2.6 build 20170517, QTS 4.3.3.0174 build 20170503 and later versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages1 packages

▶NVDqnap/qts4.2.6

🔴Vulnerability Details

3
GHSA
GHSA-5xf4-p9fw-x9pj: This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application↗2022-05-13
▶
CVEList
CVE-2017-7876: This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application↗2017-06-15
▶
VulnCheck
QNAP QTS Improper Neutralization of Special Elements used in a Command ('Command Injection')↗2017
▶
CVE-2017-7876 — Command Injection in Qnap QTS | cvebase