{"api_version":"1","generated_at":"2026-07-23T12:02:40+00:00","cve":"CVE-2017-17030","urls":{"html":"https://cve.report/CVE-2017-17030","api":"https://cve.report/api/cve/CVE-2017-17030.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-17030","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-17030"},"summary":{"title":"CVE-2017-17030","description":"A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.","state":"PUBLISHED","assigner":"qnap","published_at":"2017-12-21 15:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-119","Buffer Overflow"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://www.qnap.com/zh-tw/security-advisory/nas-201712-15","name":"https://www.qnap.com/zh-tw/security-advisory/nas-201712-15","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"title":"Security Advisory for Buffer Overflow Vulnerabilities in QTS - Security Advisory | QNAP","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1040018","name":"http://www.securitytracker.com/id/1040018","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"QNAP Storage Devices Buffer Overflow Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17030","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17030","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"QNAP","product":"QTS Login function","version":"affected 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"17030","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"qnap","cpe5":"qts","cpe6":"4.3.4.0358","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17030","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"qnap","cpe5":"qts","cpe6":"4.3.4.0370","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17030","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"qnap","cpe5":"qts","cpe6":"4.3.4.0372","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17030","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"qnap","cpe5":"qts","cpe6":"4.3.4.0374","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17030","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"qnap","cpe5":"qts","cpe6":"4.3.4.0387","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"17030","vulnerable":"1","versionEndIncluding":"4.3.3.0378","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"qnap","cpe5":"qts","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"17030","cve":"CVE-2017-17030","epss":"0.032360000","percentile":"0.872280000","score_date":"2026-05-19","updated_at":"2026-05-20 00:11:25"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T20:43:59.298Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1040018","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1040018"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.qnap.com/zh-tw/security-advisory/nas-201712-15"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"QTS Login function","vendor":"QNAP","versions":[{"status":"affected","version":"4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier"}]}],"datePublic":"2017-12-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices."}],"problemTypes":[{"descriptions":[{"description":"Buffer Overflow","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-12-22T10:57:01.000Z","orgId":"2fd009eb-170a-4625-932b-17a53af1051f","shortName":"qnap"},"references":[{"name":"1040018","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1040018"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.qnap.com/zh-tw/security-advisory/nas-201712-15"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@qnap.com","DATE_PUBLIC":"2017-12-15T00:00:00","ID":"CVE-2017-17030","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"QTS Login function","version":{"version_data":[{"version_value":"4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier"}]}}]},"vendor_name":"QNAP"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Buffer Overflow"}]}]},"references":{"reference_data":[{"name":"1040018","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1040018"},{"name":"https://www.qnap.com/zh-tw/security-advisory/nas-201712-15","refsource":"CONFIRM","url":"https://www.qnap.com/zh-tw/security-advisory/nas-201712-15"}]}}}},"cveMetadata":{"assignerOrgId":"2fd009eb-170a-4625-932b-17a53af1051f","assignerShortName":"qnap","cveId":"CVE-2017-17030","datePublished":"2017-12-21T15:00:00.000Z","dateReserved":"2017-11-28T00:00:00.000Z","dateUpdated":"2024-09-16T17:44:12.396Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-12-21 15:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-119","Buffer Overflow"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*","versionEndIncluding":"4.3.3.0378","matchCriteriaId":"743F5071-0DE8-432A-9A85-81A4519A6DA1"},{"vulnerable":true,"criteria":"cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:*","matchCriteriaId":"D560B30D-6A9F-4A44-B83B-4FAB02A94830"},{"vulnerable":true,"criteria":"cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:*","matchCriteriaId":"ACB33269-7F69-45DA-9CF0-B0322FFC577D"},{"vulnerable":true,"criteria":"cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:*","matchCriteriaId":"3CABE783-B9CA-4E15-8DC2-75C39F214600"},{"vulnerable":true,"criteria":"cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:*","matchCriteriaId":"D8B39FE2-79A9-478C-AE83-8D9664A6D1F8"},{"vulnerable":true,"criteria":"cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:*","matchCriteriaId":"DEA6AF09-BCB3-45EE-A59F-5A6CEFE8CBAC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"17030","Ordinal":"1","Title":"CVE-2017-17030","CVE":"CVE-2017-17030","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"17030","Ordinal":"1","NoteData":"A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary code on NAS devices.","Type":"Description","Title":"CVE-2017-17030"},{"CveYear":"2017","CveId":"17030","Ordinal":"2","NoteData":"2017-12-21","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"17030","Ordinal":"3","NoteData":"2017-12-22","Type":"Other","Title":"Modified"}]}}}