Vulnerability · Published Feb 3, 2021 · Assigned by qnap
CVE-2020-2507command injection vulnerability in Helpdesk
Critical 9.8
In plain English
A critical-severity command injection in Helpdesk from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.1%top 12.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | Helpdesk | unspecified – before 3.0.3 |
Weakness: CWE-77, CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-08 x_refsource_MISC