CVE-2018-0707 Public exploit EPSS 58.8%
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
QNAP · Q'center Virtual Appliance
Summary
The vulnerability is a command injection flaw in the change password functionality of QNAP's Q'center Virtual Appliance, affecting version 1.7.1063 and earlier. An attacker who is already authenticated to the appliance could exploit it to run arbitrary commands on the system.
Heading is the official description · CVE.org
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
24.8 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (Metasploit) was available 5 days before disclosure.
- Public exploit codeMetasploit5 days before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.