Medium severity · published Jun 5, 2018
CVE-2017-7639
QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of Proxy Server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Nas Proxy Server · Qnap
before 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7639
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7639
Third Party Advisory
http://www.securitytracker.com/id/1041025
Vendor Advisory
https://www.qnap.com/en/security-advisory/nas-201806-01
More from Nas Proxy Server
9.8
CVE-2017-7637
QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges
8.8
CVE-2021-34360
A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server
8.8
CVE-2017-7635
QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections
6.1
CVE-2021-34361
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server
6.1
CVE-2017-7636
Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML