title: Improper Access Control Vulnerability in Music Station
description: An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.
problem types: CWE-284 Improper Access Control
affected:
{
platforms: QTS 4.5.2
product: Music Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.3.16, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.6
product: Music Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.2.10, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.3
product: Music Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.1.14, status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTS hero h4.5.2
product: Music Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.3.16, status: affected, version: unspecified, versionType: custom
}
{
platforms: QuTScloud c4.5.4
product: Music Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.3.16, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
]
solutions: QNAP have already fixed this vulnerability in the following versions:
QTS 4.5.2: Music Station 5.3.16 and later
QTS 4.3.6: Music Station 5.2.10 and later
QTS 4.3.3: Music Station 5.1.14 and later
QuTS hero h4.5.2: Music Station 5.3.16 and later
QuTScloud c4.5.4: Music Station 5.3.16 and later