by Kastro
Paper/Archive/CVE-2020-2507

CVE-2020-2507

QNAP Systems Inc. Helpdesk — command injection vulnerability in Helpdesk

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.7.877 × 2017.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

Affected

ProductAffectedFixed inSource
Helpdeskunspecified – < 3.0.33.0.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refqnap.com/zh-tw/security-advisory/qsa-20-08