VULNERABILITY INTELLIGENCE

CVE-2020-36197

CVSS score7.1 HIGH

EPSS probability18.50%

CISA KEVNot currently listed

Published2021-05-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Description

An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.

Weakness classification

security@qnapsecurity.com.tw: CWE-284
nvd@nist.gov: CWE-22

Primary references

security@qnapsecurity.com.tw — Patch, Third Party Advisory, VDB Entry
security@qnapsecurity.com.tw — Vendor Advisory
security@qnapsecurity.com.tw — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry