RCE in Qnap Helpdesk

CVE-2018-0714

Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 and their earlier versions could allow remote attackers to run arbitrary commands…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.023 (81.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Qnap Helpdesk
  • Qnap Helpdesk In Qts — versions Helpdesk versions 1.1.21 and earlier in QTS 4.2.6: build 20180531, QTS 4.3.3: build 20180528, QTS 4.3.4: build 20180528 and earlier versions
  • Qnap Qts — versions 4.2.6, 4.3.3, 4.3.4

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2018-0714?
CVE-2018-0714 is a critical-severity vulnerability in Qnap Helpdesk, classified under Command Injection. CVSS score: 9.8/10. Published 2018-08-13.
How severe is CVE-2018-0714?
Critical severity. CVSS v3 base score is 9.8 out of 10.