QNAP NAS Proxy Server vulnerabilities

7 CVEs affecting QNAP NAS Proxy Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-34360, published 2022-05-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-7637, published 2018-06-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges.
CVE-2017-7636, published 2018-06-05. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML.
CVE-2017-7639, published 2018-06-05. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. QNAP NAS application Proxy Server through version 1.2.0 does not authenticate requests properly. Successful exploitation can lead to change of the settings of Proxy Server.
CVE-2021-34361, published 2022-02-25. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have…
CVE-2021-34359, published 2022-02-25. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have…
CVE-2017-7635, published 2018-06-05. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections.
CVE-2021-34360, published 2022-05-26. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We…