High severity · published May 13, 2021
CVE-2020-36197
An improper access control vulnerability has been reported to affect earlier versions of Music Station
8.8
CVSS
18.5%
EPSS
No
On KEV
Description
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)18.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Music Station · Qnap
before 5.3.16; before 5.2.10; before 5.1.14; before 5.3.16; before 5.3.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36197
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36197
Patch
http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.html
Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-21-08
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-591/
More from Music Station
9.8
CVE-2018-19950
If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands
9.8
CVE-2018-0729
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device
9.8
CVE-2018-0718
Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised…
9.8
CVE-2017-13069
QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier
8.8
CVE-2023-45038
Music Station