What is CVE-2017-12582?

CVE-2017-12582 is a critical-severity vulnerability in Qnap Ts-212p, classified under Missing Authorization. CVSS score: 9.8/10. Published 2017-08-18.

How severe is CVE-2017-12582?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Qnap Ts-212p

CVE-2017-12582

Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user cannot login at front end but with that unprivileged user SID, all function can access at Surveillance Station.

Vulnerability class: Broken Access Control

EPSS: 0.011 (62.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Qnap Ts-212p
Qnap Ts-212p_firmware — versions 4.2.1
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-12582?: CVE-2017-12582 is a critical-severity vulnerability in Qnap Ts-212p, classified under Missing Authorization. CVSS score: 9.8/10. Published 2017-08-18.
How severe is CVE-2017-12582?: Critical severity. CVSS v3 base score is 9.8 out of 10.