CVE-2015-7261

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kb.cert.org/vuls/id/444472Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/444472Third Party Advisory, US Government Resource

Timeline

Published: Feb 27, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-72627.5QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, allows remote authenticated users to gain privileges CVE-2015-72637.5The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a cra CVE-2015-72649.8The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks CVE-2015-72657.5Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and byp CVE-2015-72667.5The Interactive Advertising Bureau (IAB) OpenRTB 2.3 protocol implementation might allow remote attackers to conceal the status of ad transa CVE-2015-72674.2Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode and operating in Opa CVE-2015-72684.2Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in O CVE-2015-72694.2Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allow physically proximat CVE-2015-72707.8Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.CVE-2015-72719.8Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.CVE-2015-72729.8Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buff CVE-2015-72739.8Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.