title: Container Station
description: An OS command injection vulnerability has been reported to affect Container Station. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.
We have already fixed the vulnerability in the following version:
Container Station 2.6.7.44 and later
problem types: CWE-78
affected:
{
defaultStatus: unaffected
product: Container Station
vendor: QNAP Systems Inc.
versions:
lessThan: 2.6.7.44, status: affected, version: 2.6.x.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: We have already fixed the vulnerability in the following version:
Container Station 2.6.7.44 and later
