« Volver al listado

CVE-2018-0729

Estado: ModificadaCrítica (9.8)—

This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Qnap — Music Station

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-0729",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@qnapsecurity.com.tw",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "QNAP NAS devices",
          "versions": [
            {
              "status": "affected",
              "version": "QTS 4.4.1: Music Station before version 5.3.5, QTS 4.3.6: Music Station before version 5.2.7, QTS 4.3.4: Music Station before version 5.1.11, QTS 4.3.3: Music Station before version 5.1.11, QTS 4.2.6: Music Station before version 4.8.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-12-04T17:16:42.913",
  "references": [
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201911-20",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@qnapsecurity.com.tw"
    },
    {
      "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201911-20",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad de inyección de comandos en Music Station permite a atacantes ejecutar comandos sobre el dispositivo afectado. Para corregir la vulnerabilidad, QNAP recomienda actualizar Music Station a sus últimas versiones."
    }
  ],
  "lastModified": "2026-06-17T01:31:32.117",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25941E8B-2FB7-415E-AC30-8EC90EF99C06",
              "versionEndExcluding": "5.3.5"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.4.1:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "47B6D38A-D7C9-4D55-921C-488D56C43F25"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A83BC796-C1F9-4800-A95C-FCF8148F9926",
              "versionEndExcluding": "5.2.7"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13FE8FEA-014D-4284-8A88-2DCE5206B07A",
              "versionEndExcluding": "5.1.11"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13FE8FEA-014D-4284-8A88-2DCE5206B07A",
              "versionEndExcluding": "5.1.11"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97105107-E3BB-4F9C-BBF6-A1B2643C9C4F",
              "versionEndExcluding": "4.8.8"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1D9E6F8F-A433-45A7-8839-5D478FE179A4"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw"
}