9.8crit
CVE-2018-0712
Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and the…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 85%
Public exploits
0
none known
Summary
Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS.
Exploit prediction (EPSS)
2.51% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- QNAP LDAP Server in QTS
Classification
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
- qnap.com /zh-tw/security-advisory/nas-201806-19 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1041141 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2018-0712
- NVD: CVE-2018-0712
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.