Critical severity · published Dec 4, 2019
CVE-2018-0729
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device
9.8
CVSS
2.3%
EPSS
No
On KEV
Description
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating Music Station to their latest versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Music Station · Qnap
before 5.3.5; before 5.2.7; before 5.1.11; before 5.1.11; before 4.8.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0729
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0729
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201911-20
More from Music Station
9.8
CVE-2018-19950
If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands
9.8
CVE-2018-0718
Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised…
9.8
CVE-2017-13069
QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier
8.8
CVE-2023-45038
Music Station
8.8
CVE-2020-36197
An improper access control vulnerability has been reported to affect earlier versions of Music Station