CVE-2020-36197highCWE-284

CVE-2020-36197: high-severity vulnerability in QNAP Systems Inc. Music Station

Improper Access Control Vulnerability in Music Station

Published · Updated

Follow this CVE+ Monitor Music Station

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 18%
In short

Music Station has an access control flaw that allows attackers to bypass security restrictions and gain unauthorized privileges, read sensitive data, or execute commands on affected systems.

Technical detail

An improper access control vulnerability (CWE-284) in QNAP Music Station versions prior to specified patches allows unauthenticated or low-privileged attackers to escalate privileges, access sensitive information, and execute arbitrary commands. The vulnerability affects multiple QTS and QuTS platforms, with vector likely being local or network-based depending on deployment context.

Summary generated and translated by AI from the official description.
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected products
QNAP Systems Inc. · Music Station
Related CVEs — QNAP Systems Inc. Music Station

In the same product, most dangerous first.

CVE-2018-19950—CVE-2018-19950EPSS 2.1%CVE-2018-19952—CVE-2018-19952EPSS 1.3%CVE-2023-45038MEDIUMMusic StationEPSS 1.2%CVE-2020-2494—Cross-site Scripting Vulnerability in Music StationEPSS 1.0%CVE-2018-19951—CVE-2018-19951EPSS 0.8%CVE-2023-39299HIGHMusic StationEPSS 0.7%