Chad Seaman

An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models. If exploited, the vulnerability could allow authenticated users to execute commands via a network. The vulnerability exists due to the lack of measures to neutralize special elements. It is reported that the vulnerability has been exploited in the wild. Approximately 27,804 devices are potentially affected, mainly distributed in Japan, Mexico, and other countries.

An OS command injection vulnerability exists, allowing an attacker who can log in to the product to execute arbitrary OS commands. The vulnerability is related to the lack of measures to neutralize special elements used in the OS command. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary commands. New botnet malware has been found to exploit this flaw in routers.

The issue concerns the Multicast DNS (mDNS) responder, which responds to unicast queries with source addresses that are not link-local. This allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets.

The issue allows remote attackers to cause a denial of service or obtain potentially sensitive information via port-5353 UDP packets to the Avahi component. This is due to the Multicast DNS (mDNS) responder inadvertently responding to unicast queries with source addresses that are not link-local.