CVE-2017-7876: Command Injection
Published Jun 15, 2017
·Updated
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS 4.2.6 build 20170517, QTS 4.3.3.0174 build 20170503 and later versions.
Affected Software
1 affected component
QNAP QTS<=4.2.6
Event History
Jun 15, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2017-7876?
CVE-2017-7876 has a critical severity rating due to its potential for remote command execution.
2
How do I fix CVE-2017-7876?
To fix CVE-2017-7876, update to QTS version 4.2.6 build 20170517 or QTS version 4.3.3.0174 build 20170503 and later.
3
What impact does CVE-2017-7876 have?
CVE-2017-7876 allows attackers to execute arbitrary commands on vulnerable QNAP devices.
4
Which QTS versions are affected by CVE-2017-7876?
QTS versions prior to 4.2.6 build 20170517 and 4.3.3.0174 build 20170503 are affected by CVE-2017-7876.
5
Is CVE-2017-7876 still a threat to my device?
If your QTS version is updated to a fixed version, CVE-2017-7876 is no longer a threat.