QNAP QTS Music Station command injection [CVE-2018-0729] – Digitalmunition

Exploit no image

Published on December 6th, 2019 📆 | 6632 Views ⚑


QNAP QTS Music Station command injection [CVE-2018-0729]

CVSS Meta Temp ScoreCurrent Exploit Price (≈)CTI Interest Score

A vulnerability, which was classified as critical, has been found in QNAP QTS (Network Attached Storage Software) (unknown version). This issue affects an unknown function of the component Music Station. The manipulation with an unknown input leads to a privilege escalation vulnerability (Command Injection). Using CWE to declare the problem leads to CWE-88. Impacted is confidentiality, integrity, and availability.

The weakness was disclosed 12/04/2019. The advisory is shared at qnap.com. The identification of this vulnerability is CVE-2018-0729 since 11/28/2017. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/05/2019).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry 146656 is pretty similar.




VulDB Meta Base Score: 5.5
VulDB Meta Temp Score: 5.5

VulDB Base Score: ≈5.5
VulDB Temp Score: ≈5.5
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Privilege escalation / Command Injection (CWE-88)
Local: Yes
Remote: No

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: no mitigation known

0-Day Time: 🔒

11/28/2017 CVE assigned
12/04/2019 +736 days Advisory disclosed
12/05/2019 +1 days VulDB entry created
12/05/2019 +0 days VulDB last updateVendor: qnap.com

Advisory: qnap.com

CVE: CVE-2018-0729 (🔒)
See also: 🔒

Created: 12/05/2019 07:06 AM
Complete: 🔍

Check our Alexa App!


Tagged with:

Leave a Reply ✍