« Volver al listado

CVE-2017-17027

Estado: ModificadaCrítica (9.8)—

Una vulnerabilidad de desbordamiento de búfer en el servicio FTP de QNAP QTS, en sus versiones 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 y anteriores podría permitir que atacantes remotos ejecuten código arbitrario en dispositivos NAS.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qnap — QTS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-17027",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "QNAP",
          "product": "QTS FTP service",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-12-21T15:29:00.427",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1040018",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201712-15",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "http://www.securitytracker.com/id/1040018",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201712-15",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento de búfer en el servicio FTP de QNAP QTS, en sus versiones 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 y anteriores podría permitir que atacantes remotos ejecuten código arbitrario en dispositivos NAS."
    }
  ],
  "lastModified": "2026-06-17T01:10:14.960",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "743F5071-0DE8-432A-9A85-81A4519A6DA1",
              "versionEndIncluding": "4.3.3.0378"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D560B30D-6A9F-4A44-B83B-4FAB02A94830"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACB33269-7F69-45DA-9CF0-B0322FFC577D"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CABE783-B9CA-4E15-8DC2-75C39F214600"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8B39FE2-79A9-478C-AE83-8D9664A6D1F8"
            },
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEA6AF09-BCB3-45EE-A59F-5A6CEFE8CBAC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}