QNAP Q'center vulnerabilities

7 CVEs affecting QNAP Q'center, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-28803, published 2021-07-01.

More from QNAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-0707, published 2018-07-17. High severity, CVSS 7.2. EPSS: 58.8% chance of exploitation in the next 30 days. Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
• CVE-2018-0706, published 2018-07-17. High severity, CVSS 8.8. EPSS: 48.3% chance of exploitation in the next 30 days. Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
• CVE-2018-0708, published 2018-07-17. High severity, CVSS 8.8. EPSS: 26% chance of exploitation in the next 30 days. Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
• CVE-2018-0710, published 2018-07-17. High severity, CVSS 8.8. EPSS: 14.1% chance of exploitation in the next 30 days. Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
• CVE-2018-0709, published 2018-07-17. High severity, CVSS 8.8. EPSS: 13.4% chance of exploitation in the next 30 days. Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
• CVE-2021-28807, published 2021-06-03. Medium severity, CVSS 5.4. EPSS: 1.4% chance of exploitation in the next 30 days. A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have…
• CVE-2021-28803, published 2021-07-01. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004.