CVE-2018-0712: Command Injection
Published Jun 21, 2018
·Updated
Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions could allow remote attackers to run arbitrary commands or install malware on the NAS.
Affected Software
3 affected components
QNAP QTS=4.2.6
QNAP QTS=4.3.3
QNAP QTS<=4.3.4
Event History
Jun 21, 2018
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-0712?
CVE-2018-0712 is considered a critical vulnerability that can allow remote attackers to execute arbitrary commands.
2
How do I fix CVE-2018-0712?
To mitigate CVE-2018-0712, users should upgrade to a patched version of QTS beyond 4.3.4.
3
What are the affected versions for CVE-2018-0712?
CVE-2018-0712 affects QNAP QTS versions 4.2.6, 4.3.3, and 4.3.4 and all earlier versions.
4
Can CVE-2018-0712 be exploited remotely?
Yes, CVE-2018-0712 can be exploited remotely without authentication.
5
What type of attack is CVE-2018-0712 associated with?
CVE-2018-0712 is associated with command injection attacks.