CVE-2018-0718

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised application.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
QNAP	Music Station	5.1.2 and earlier versions in QTS 4.3.3 and 4.3.4

References

https://www.qnap.com/zh-tw/security-advisory/nas-201809-14Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201809-14Vendor Advisory

Timeline

Published: Sep 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-07195.5Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc. QTS allows attackers to inject javascript. This issue affects: CVE-2018-07217.7Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version CVE-2018-07227.5Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in CVE-2018-07236.1Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject CVE-2018-07246.1Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject CVE-2018-07287.5This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend CVE-2018-07299.8This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability,CVE-2018-07309.8This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, CVE-2018-07327.5During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. CVE-2018-07335.9Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of ea CVE-2018-07345.9The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the CVE-2018-07355.9The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in t