CVE-2017-10700

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS application.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.lateralsecurity.com/downloads/Lateral_Security-Advisory-QNAP_QTS_CVE-2017-10700.pdfThird Party Advisory
https://www.qnap.com/en/support/con_show.php?cid=128Vendor Advisory
https://www.lateralsecurity.com/downloads/Lateral_Security-Advisory-QNAP_QTS_CVE-2017-10700.pdfThird Party Advisory
https://www.qnap.com/en/support/con_show.php?cid=128Vendor Advisory

Timeline

Published: Sep 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-107016.1Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web script or HTML, aka S CVE-2017-107066.2When Antiy Antivirus Engine before 5.0.0.05171547 scans a special ZIP archive, it crashes with a stack-based buffer overflow because a fixed CVE-2017-107087.8An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run CVE-2017-107096.8The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature b CVE-2017-107116.1In SimpleRisk 20170614-001, a CSRF attack on reset.php (aka the Send Password Reset Email form) can insert XSS sequences via the user parame CVE-2017-107186.5Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user CVE-2017-107196.5Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has def CVE-2017-107207.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop applic CVE-2017-107216.5Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Tel CVE-2017-107227.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop applic CVE-2017-107238.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connec CVE-2017-107248.8Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connec