CVE-2017-13067: Critical severity QNAP QTS vulnerability
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13067?
CVE-2017-13067 is classified as a high severity vulnerability due to its potential for remote code execution on affected devices.
How do I fix CVE-2017-13067?
To fix CVE-2017-13067, update your QNAP QTS firmware to versions 4.2.6 build 20170905 or later, or 4.3.3.0299 build 20170901 or later.
Which versions of QNAP QTS are affected by CVE-2017-13067?
CVE-2017-13067 affects all versions of QNAP QTS prior to 4.2.6 build 20170905 and 4.3.3.0299 build 20170901.
What type of vulnerability is CVE-2017-13067?
CVE-2017-13067 is a remote code execution vulnerability that affects the QTS Media Library on QNAP NAS devices.
Can CVE-2017-13067 be exploited remotely?
Yes, CVE-2017-13067 can be exploited remotely by attackers using a transcoding service on port 925.