Critical severity · published Sep 14, 2018
CVE-2018-0718
Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised…
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised application.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Music Station · Qnap
through 5.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0718
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201809-14
More from Music Station
9.8
CVE-2018-19950
If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands
9.8
CVE-2018-0729
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device
9.8
CVE-2017-13069
QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier
8.8
CVE-2023-45038
Music Station
8.8
CVE-2020-36197
An improper access control vulnerability has been reported to affect earlier versions of Music Station