Improper Access Control Vulnerability in Music Station
CVE-2020-36197

7.1HIGH

Key Information:

Vendor
QNAP
Status
Music Station
Vendor
CVE Published:
13 May 2021

Summary

An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.

Affected Version(s)

Music Station QTS 4.3.3 < 5.1.14

Music Station QTS 4.3.6 < 5.2.10

Music Station QTS 4.5.2 < 5.3.16

References

https://www.qnap.com/zh-tw/security-advisory/qsa-21-08
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-591/
x_refsource_MISC
http://packetstormsecurity.com/files/162849/QNAP-MusicSta...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trend Micro ZDI - ZDI-CAN-12048
.