CVE-2019-7198

CRITICAL

9.8

Description

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/10/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

qnap:qtsqnap:quts_hero

Weaknesses (CWE)

CWE-77CWE-78CWE-77

References

https://www.qnap.com/en/security-advisory/qsa-20-16(security@qnapsecurity.com.tw)

https://www.qnap.com/en/security-advisory/qsa-20-16(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.