CVE-2018-0707 : Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could

Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.

Published 2018-07-17 01:29:03

Updated 2019-10-03 00:03:26

Source QNAP Systems, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-0707

Probability of exploitation activity in the next 30 days: 6.67%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 94 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2018-0707

QNAP Q'Center change_passwd Command Execution

Disclosure Date: 2018-07-11

First seen: 2020-04-26

exploit/linux/http/qnap_qcenter_change_passwd_exec

This module exploits a command injection vulnerability in the `change_passwd` API method within the web interface of QNAP Q'Center virtual appliance versions prior to 1.7.1083. The vulnerability allows the 'admin' privileged user account to execute arbitrary

More information

CVSS scores for CVE-2018-0707

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.2	HIGH	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-0707

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-0707

http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html

QNAP Qcenter Virtual Appliance 1.6.x Information Disclosure / Command Injection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities

QNAP Qcenter Virtual Appliance Multiple Vulnerabilities | Core Security
Exploit;Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2018/Jul/45

Full Disclosure: [CORE-2018-0006] - QNAP Qcenter Virtual Appliance Multiple Vulnerabilities
Exploit;Mailing List;Third Party Advisory

CVEs referencing this url
https://www.qnap.com/zh-tw/security-advisory/nas-201807-10

Security Advisory for Vulnerabilities in Q’center Virtual Appliance - Technical Advisory | QNAP
Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/45043/

QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.exploit-db.com/exploits/45015/

QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.securityfocus.com/archive/1/542141/100/0/threaded

SecurityFocus
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2018-0707

Qnap » Q'center
Versions up to, including, (<=) 1.7.1063
cpe:2.3:a:qnap:q\'center:*:*:*:*:*:*:*:*
Matching versions