CVE-2017-13067: QNAP QTS

Critical severity, CVSS 9.8. EPSS: 16.7% chance of exploitation in the next 30 days.

QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.

Affected products

• QNAP QTS: from 4.2.0, up to and including 4.2.6; from 4.3.0, up to and including 4.3.3.0299

Published 2017-09-14. Last modified 2026-06-17.