Unscored severity · published Oct 16, 2015
CVE-2015-6003
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to…
–
CVSS
4.1%
EPSS
No
On KEV
Description
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QT
Qts · Qnap
through 4.1.4; through 4.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6003
Third Party Advisory
http://www.kb.cert.org/vuls/id/751328
www.securitytracker.com
http://www.securitytracker.com/id/1033794
Vendor Advisory
https://www.qnap.com/i/en/support/con_show.php?cid=85
More from Qts
9.8
CVE-2020-2509
Command Injection Vulnerability in QTS and QuTS hero
9.8
CVE-2018-19949
QNAP NAS File Station Command Injection Vulnerability
9.8
CVE-2019-7193
QNAP QTS Improper Input Validation Vulnerability
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability