CVE-2018-0721

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Systems Inc. QTS version 4.2.6 and prior versions on build 20180711; version 4.3.3 and prior versions on build 20180725; version 4.3.4 and prior versions on build 20180710.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L

Weakness enumeration

CWE-120 CWE-119

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QTS	>= unspecified, <= 4.2.6
QNAP Systems Inc.	QTS	>= unspecified, <= 4.3.3
QNAP Systems Inc.	QTS	>= unspecified, <= 4.3.4

References

https://www.qnap.com/zh-tw/security-advisory/nas-201809-20Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/nas-201809-20Vendor Advisory

Timeline

Published: Nov 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-07227.5Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in CVE-2018-07236.1Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject CVE-2018-07246.1Cross-site scripting (XSS) vulnerability in Q'center Virtual Appliance 1.8.1014 and earlier versions could allow remote attackers to inject CVE-2018-07287.5This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend CVE-2018-07299.8This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability,CVE-2018-07309.8This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, CVE-2018-07327.5During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. CVE-2018-07335.9Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of ea CVE-2018-07345.9The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the CVE-2018-07355.9The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in t CVE-2018-07375.9The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient CVE-2018-07396.5Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input