CVE-2018-0729
Status: ModifiedCritical (9.8)—
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base score: 9.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.34%
- Percentile among all scored CVEs: 83
- Score date: 10/4/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-77
References
Raw JSON (NVD)
Show
{
"id": "CVE-2018-0729",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security@qnapsecurity.com.tw",
"affectedData": [
{
"vendor": "n/a",
"product": "QNAP NAS devices",
"versions": [
{
"status": "affected",
"version": "QTS 4.4.1: Music Station before version 5.3.5, QTS 4.3.6: Music Station before version 5.2.7, QTS 4.3.4: Music Station before version 5.1.11, QTS 4.3.3: Music Station before version 5.1.11, QTS 4.2.6: Music Station before version 4.8.8"
}
]
}
]
}
],
"published": "2019-12-04T17:16:42.913",
"references": [
{
"url": "https://www.qnap.com/zh-tw/security-advisory/nas-201911-20",
"tags": [
"Vendor Advisory"
],
"source": "security@qnapsecurity.com.tw"
},
{
"url": "https://www.qnap.com/zh-tw/security-advisory/nas-201911-20",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions."
},
{
"lang": "es",
"value": "Esta vulnerabilidad de inyección de comandos en Music Station permite a atacantes ejecutar comandos sobre el dispositivo afectado. Para corregir la vulnerabilidad, QNAP recomienda actualizar Music Station a sus últimas versiones."
}
],
"lastModified": "2026-06-17T01:31:32.117",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25941E8B-2FB7-415E-AC30-8EC90EF99C06",
"versionEndExcluding": "5.3.5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.4.1:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "47B6D38A-D7C9-4D55-921C-488D56C43F25"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A83BC796-C1F9-4800-A95C-FCF8148F9926",
"versionEndExcluding": "5.2.7"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FE9FAC96-AA2A-4CA5-A170-8C0E6BD47391"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13FE8FEA-014D-4284-8A88-2DCE5206B07A",
"versionEndExcluding": "5.1.11"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13FE8FEA-014D-4284-8A88-2DCE5206B07A",
"versionEndExcluding": "5.1.11"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97105107-E3BB-4F9C-BBF6-A1B2643C9C4F",
"versionEndExcluding": "4.8.8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1D9E6F8F-A433-45A7-8839-5D478FE179A4"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "security@qnapsecurity.com.tw"
}