Log in Start free

Vulnerability · Published Apr 17, 2021 · Assigned by qnap

CVE-2020-36195SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On

Critical 9.8

In plain English

A critical-severity improper input validation in Media Streaming add-on from QNAP Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.8%top 21.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later

Affected products (as reported)

VendorProductVersions
QNAP Systems Inc. QTS unspecified – before 4.3.3.1624 Build 20210416unspecified – before 4.3.6.1620 Build 20210322
QNAP Systems Inc. Media Streaming add-on unspecified – before 430.1.8.10unspecified – before 430.1.8.8
QNAP Systems Inc. Multimedia Console unspecified – before 1.3.4

Weakness: CWE-20, CWE-89, CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References