Signature Detail

APP: QNAP Transcode Server Command Injection

This signature detects attempts to exploit a known vulnerability against QNAP Transcode Server. A successful exploit can lead to remote code execution.

Extended Description

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.

Affected Products

• Qnap qts 4.2.0
• Qnap qts 4.2.1
• Qnap qts 4.2.2
• Qnap qts 4.2.3
• Qnap qts 4.2.4
• Qnap qts 4.2.6
• Qnap qts 4.3.1.0013
• Qnap qts 4.3.1.0023
• Qnap qts 4.3.2.0050
• Qnap qts 4.3.2.0060
• Qnap qts 4.3.2.0144
• Qnap qts 4.3.3
• Qnap qts 4.3.3.0095
• Qnap qts 4.3.3.0096
• Qnap qts 4.3.3.0136
• Qnap qts 4.3.3.0154
• Qnap qts 4.3.3.0188
• Qnap qts 4.3.3.0210
• Qnap qts 4.3.3.0229
• Qnap qts 4.3.3.0238
• Qnap qts 4.3.3.0262
• Qnap qts 4.3.3.0299

References

• CVE: CVE-2017-13067
• URL: http://docs.qnap.com/nas/4.1/Home/en/index.html?transcode_management.htm