Security ID : QSA-21-08

Improper Access Control Vulnerability in Music Station


  • Release date : May 6, 2021

  • CVE identifier : CVE-2020-36197

  • Affected products: QNAP NAS running Music Station

Severity

Important

Status

Resolved


Summary

An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc.

We have already fixed this vulnerability in the following versions:

  • QTS 4.5.2: Music Station 5.3.16 and later
  • QTS 4.3.6: Music Station 5.2.10 and later
  • QTS 4.3.3: Music Station 5.1.14 and later
  • QuTS hero h4.5.2: Music Station 5.3.16 and later
  • QuTScloud c4.5.4: Music Station 5.3.16 and later

Recommendation

To fix the vulnerability, we recommend updating Music Station to the latest version.

Updating Music Station

  1. Log on to QTS or QuTS hero as administrator.
  2. Open the App Center and then click .
    A search box appears.
  3. Type “Music Station” and then press ENTER.
    Music Station appears in the search results.
  4. Click Update.
    A confirmation message appears.
    Note: The Update button is not available if your Music Station is already up to date.
  5. Click OK.
    The application is updated.

Acknowledgements: polict of Shielder working with Trend Micro’s Zero Day Initiative

Revision History:
V2.1 (May 14, 2021) - Update Acknowledgements
V2.0 (May 13, 2021) - Update Status, Severity, CVE ID, Summary and Acknowledgments
V1.0 (May 6, 2021) - Published

Choisissez une spécification

      En voir davantage Moins

      Ce site est disponible dans d'autres pays/régions :

      open menu
      back to top