6.5med
CVE-2017-7638
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 52%
Public exploits
0
none known
Summary
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.
Exploit prediction (EPSS)
0.67% probability of exploitation in the next 30 days, higher than 52% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Affected products
- QNAP QNAP Media Streaming Add-On
Classification
- Weakness
- CWE-287 Improper Authentication
References
- qnap.com /zh-tw/security-advisory/nas-201803-08 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-7638
- NVD: CVE-2017-7638
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.