CVE-2020-25847 - OpenCVE

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Qnap	Qts Quts Hero

Configuration 1 [-]

OR	cpe:2.3:o:qnap:qts::::::::
	cpe:2.3:o:qnap:quts_hero::::::::

No data.

References

Link	Providers
https://www.qnap.com/en/security-advisory/qsa-20-20

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2020-12-29T07:10:13.047777Z

Updated: 2024-09-16T16:28:10.857Z

Reserved: 2020-09-23T00:00:00

Link: CVE-2020-25847

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-12-29T07:15:13.213

Modified: 2020-12-30T16:15:56.807

Link: CVE-2020-25847

Redhat

No data.

{"containers": {"cna": {"affected": [{"platforms": ["build 20201123"], "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "4.5.1.1495", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"platforms": ["build 20200930"], "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"lessThanOrEqual": "4.4.3.1444", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"status": "unaffected", "version": "4.3.x"}, {"status": "unaffected", "version": "4.2.x"}]}, {"platforms": ["build 20201119"], "product": "QuTS hero", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "h4.5.1.1491", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "CFF of Topsec Alpha Team"}], "datePublic": "2020-12-30T00:00:00", "descriptions": [{"lang": "en", "value": "This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 OS Command Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-12-29T07:10:12", "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.qnap.com/en/security-advisory/qsa-20-20"}], "solutions": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1491 build 20201119 and later\nQTS 4.5.1.1495 build 20201123 and later\n\nThis issue does not affect QTS 4.3.x and QTS 4.2.x."}], "source": {"advisory": "QSA-20-20", "discovery": "EXTERNAL"}, "title": "Command Injection Vulnerability in QTS and QuTS hero", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "TWCERT/CC", "ASSIGNER": "cve@cert.org.tw", "DATE_PUBLIC": "2020-12-30T06:00:00.000Z", "ID": "CVE-2020-25847", "STATE": "PUBLIC", "TITLE": "Command Injection Vulnerability in QTS and QuTS hero"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "QTS", "version": {"version_data": [{"platform": "build 20201123", "version_affected": "<", "version_value": "4.5.1.1495"}, {"platform": "build 20200930", "version_affected": "<=", "version_value": "4.4.3.1444"}, {"version_affected": "!", "version_value": "4.3.x"}, {"version_affected": "!", "version_value": "4.2.x"}]}}, {"product_name": "QuTS hero", "version": {"version_data": [{"platform": "build 20201119", "version_affected": "<", "version_value": "h4.5.1.1491"}]}}]}, "vendor_name": "QNAP Systems Inc."}]}}, "credit": [{"lang": "eng", "value": "CFF of Topsec Alpha Team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}, {"description": [{"lang": "eng", "value": "CWE-78 OS Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.qnap.com/en/security-advisory/qsa-20-20", "refsource": "MISC", "url": "https://www.qnap.com/en/security-advisory/qsa-20-20"}]}, "solution": [{"lang": "en", "value": "QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.\n\nQuTS hero h4.5.1.1491 build 20201119 and later\nQTS 4.5.1.1495 build 20201123 and later\n\nThis issue does not affect QTS 4.3.x and QTS 4.2.x."}], "source": {"advisory": "QSA-20-20", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:40:37.029Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.qnap.com/en/security-advisory/qsa-20-20"}]}]}, "cveMetadata": {"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "cveId": "CVE-2020-25847", "datePublished": "2020-12-29T07:10:13.047777Z", "dateReserved": "2020-09-23T00:00:00", "dateUpdated": "2024-09-16T16:28:10.857Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEF3653A-C33D-4AE2-9DF1-4C66974BE83D", "versionEndExcluding": "4.5.1.1495", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E5F3C12-C5EE-48AF-A232-A04C539916E8", "versionEndExcluding": "h4.5.1.1491", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero."}, {"lang": "es", "value": "Esta vulnerabilidad de inyecci\u00f3n de comandos permite a atacantes ejecutar comandos arbitrarios en una aplicaci\u00f3n comprometida. QNAP ya ha corregido esta vulnerabilidad en las siguientes versiones de QTS y QuTS hero"}], "id": "CVE-2020-25847", "lastModified": "2020-12-30T16:15:56.807", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}]}, "published": "2020-12-29T07:15:13.213", "references": [{"source": "twcert@cert.org.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/en/security-advisory/qsa-20-20"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}