Security Advisory for Command Injection in Music Station

Summary

Security researcher Yoni Ramon discovered a number of command injection vulnerabilities found in Music Station. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS. QNAP acknowledges Mr. Ramon’s discovery and appreciates his efforts.

QNAP has already patched these vulnerabilities in Music Station versions 4.8.7 and 5.0.8.

Recommendations

To resolve the issue, you must update your Music Station to the latest version:

• For QTS 4.2.x: Music Station 4.8.7
• For QTS 4.3.x: Music Station 5.0.8

Upgrading to Music Station 4.8.7 or 5.0.8

1. Log on to QTS as administrator.
2. Open the App Center, and then click the Search icon.
   A search box appears.
3. Type “Music Station”, and then press ENTER.
   The Music Station application appears in the search results list.
4. Click Update.
   A confirmation message appears.
5. Click OK.
   The application is updated.