CVE-2013-0144

Name of the Vulnerable Software and Affected Versions QNAP VioStor NVR devices with firmware 4.0.3

Description A cross-site request forgery (CSRF) issue affects the cgi-bin/create user.cgi endpoint, allowing remote attackers to hijack administrator authentication for creating administrative accounts via a NEW USER action.

Recommendations For QNAP VioStor NVR devices with firmware 4.0.3, consider disabling access to the cgi-bin/create user.cgi endpoint until a patch is available to prevent exploitation of the CSRF issue.