CVE-2013-0143

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string.

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

6.97% chance of exploitation in the next 30 days, 94th percentile

Published

2013-06-07

Updated

2024-09-17

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38550

References

• CVE Record
• NVD entry

Related

• CVE-2013-0141
• CVE-2013-0145
• CVE-2013-0140
• CVE-2013-0156
• CVE-2013-0136
• CVE-2013-0160