CVE-2017-5227

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/97056Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/97072
http://www.securitytracker.com/id/1038091Third Party Advisory, VDB Entry
http://www.ush.it/team/ush/hack-qnap/qnap.txtThird Party Advisory
https://www.exploit-db.com/exploits/41745/
https://www.qnap.com/en-us/releasenotes/Release Notes, Vendor Advisory
https://www.qnap.com/en/support/con_show.php?cid=113Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/97056Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/97072
http://www.securitytracker.com/id/1038091Third Party Advisory, VDB Entry
http://www.ush.it/team/ush/hack-qnap/qnap.txtThird Party Advisory
https://www.exploit-db.com/exploits/41745/
https://www.qnap.com/en-us/releasenotes/Release Notes, Vendor Advisory
https://www.qnap.com/en/support/con_show.php?cid=113Mitigation, Vendor Advisory

Timeline

Published: Mar 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-52287.1All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi D CVE-2017-52297.1All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi C CVE-2017-52307.2The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' whi CVE-2017-52317.1All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi C CVE-2017-52327.8All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the ins CVE-2017-52337.8Rapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer t CVE-2017-52347.8Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer CVE-2017-52357.8Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the i CVE-2017-52367.8Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the CVE-2017-52377.5Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a fa CVE-2017-52385.3Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one varia CVE-2017-52397.5Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Evie