What is CVE-2017-7638?

CVE-2017-7638 is a medium-severity vulnerability in QNAP Media Streaming Add-On, classified under Improper Authentication. CVSS score: 6.5/10. Published 2018-03-08.

How severe is CVE-2017-7638?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in QNAP Media Streaming Add-On

CVE-2017-7638

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could lead to change of the Media Streaming settings, and leakage of sensitive information of the QNAP NAS.

Vulnerability class: Broken Authentication

EPSS: 0.007 (48.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Qnap Media_streaming_add-on
Qnap Media Streaming Add-on — versions 421.1.0.2, 430.1.2.0, and earlier
Qnap Qts — versions 4.3.3

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

security@qnapsecurity.com.tw (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-7638?: CVE-2017-7638 is a medium-severity vulnerability in QNAP Media Streaming Add-On, classified under Improper Authentication. CVSS score: 6.5/10. Published 2018-03-08.
How severe is CVE-2017-7638?: Medium severity. CVSS v3 base score is 6.5 out of 10.