CVE-2017-13069 Command injection in n/a
Remote attackers can execute arbitrary commands on QNAP NAS devices via vulnerabilities in the Music Station application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-13069?
CVE-2017-13069 is a critical command injection vulnerability in n/a, published on 6 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS.
Weakness: CWE-77
Which versions are affected by CVE-2017-13069?
It affects 1 product.
Products include Qnap Music Station.
How do I fix CVE-2017-13069?
No fix has been published for CVE-2017-13069 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-13069 being exploited?
There is no known exploitation of CVE-2017-13069 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CVE-2017-5678, GHSA-w899-6vwg-gf6x.