CVE-2018-0709

Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.

• CWE-78

• http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/45Exploit, Mailing List, Third Party Advisory
• https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitiesExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45015/Exploit, Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/nas-201807-10Vendor Advisory
• https://www.securityfocus.com/archive/1/542141/100/0/threadedExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Jul/45Exploit, Mailing List, Third Party Advisory
• https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitiesExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45015/Exploit, Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/nas-201807-10Vendor Advisory
• https://www.securityfocus.com/archive/1/542141/100/0/threadedExploit, Third Party Advisory, VDB Entry

Published

Jul 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0703Directory traversal vulnerability in Cybozu Office 10.0.0 to…
• CVE-2018-0704Directory traversal vulnerability in Cybozu Office 10.0.0 to…
• CVE-2018-0705Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8…
• CVE-2018-0706Exposure of Private Information in QNAP Q'center Virtual App…
• CVE-2018-0707Command injection vulnerability in change password of QNAP Q…
• CVE-2018-0708Command injection vulnerability in networking of QNAP Q'cent…
• CVE-2018-0710Command injection vulnerability in SSH of QNAP Q'center Virt…
• CVE-2018-0711Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 b…
• CVE-2018-0712Command injection vulnerability in LDAP Server in QNAP QTS 4…
• CVE-2018-0714Command injection vulnerability in Helpdesk versions 1.1.21 …
• CVE-2018-0715Cross-site scripting vulnerability in QNAP Photo Station ver…
• CVE-2018-0716Cross-site scripting vulnerability in QTS 4.2.6 build 201807…