Medium severity · published Mar 8, 2018
CVE-2017-7638
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Media Streaming Add-on · Qnap
through 430.1.2.0; through 421.1.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7638
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7638
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201803-08
More from Media Streaming Add-on
9.8
CVE-2023-47222
An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on
9.8
CVE-2023-23369
An OS command injection vulnerability has been reported to affect several QNAP operating system versions
9.8
CVE-2020-36195
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on
9.8
CVE-2017-7640
QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges
9.1
CVE-2025-59383
Media Streaming Add-on