title: Command Injection Vulnerability in Video Station
description: A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.
problem types: CWE-1286 Improper Validation of Syntactic Correctness of Input
affected:
{
platforms: QTS 4.5.2
product: Video Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.5.4, status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTS hero h4.5.2
product: Video Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.5.4, status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTScloud c4.5.4
product: Video Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.5.4, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.6
product: Video Station
vendor: QNAP Systems Inc.
versions:
status: unaffected, version: 5.3.x
}
{
platforms: QTS 4.3.3
product: Video Station
vendor: QNAP Systems Inc.
versions:
status: unaffected, version: 5.1.x
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: QNAP have already fixed the issue in the following versions:
QTS 4.5.2: Video Station 5.5.4 and later
QuTS hero h4.5.2: Video Station 5.5.4 and later
QuTScloud c4.5.4: Video Station 5.5.4 and later