by Kastro
Paper/Archive/CVE-2024-50387

CVE-2024-50387

QNAP Systems Inc. SMB Service — SMB Service

EPSS 10%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 95.6.956 × 2019.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: SMB Service 4.15.002 and later SMB Service h4.15.002 and later

Affected

ProductAffectedFixed inSource
SMB Service4.15.x – < 4.15.0024.15.002CNA
SMB Serviceh4.15.x – < h4.15.002h4.15.002CNA
smb_service4.15.x – < 4.15.0024.15.002CISA-ADP
smb_serviceh4.15.x – < h4.15.002h4.15.002CISA-ADP

Scores by source

qnap (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refqnap.com/en/security-advisory/qsa-24-42