CVE-2017-13067

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.2.6 build 20170905 QNAP QTS versions prior to 4.3.3.0299 build 20170901

Description The issue allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.

Recommendations For QNAP QTS versions prior to 4.2.6 build 20170905, update to QTS 4.2.6 build 20170905 or later. For QNAP QTS versions prior to 4.3.3.0299 build 20170901, update to QTS 4.3.3.0299 build 20170901 or later. As a temporary workaround, consider restricting access to the transcoding service on port 9251 until a patch is applied.