CVE-2018-0707: QNAP Q'center Virtual Appliance command injection in change password

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityNetwork-reachable authenticated command injection with public exploit code and very high EPSS, but it requires valid credentials and is not in KEV.

What it is

The change password function in QNAP Q'center Virtual Appliance 1.7.1063 and earlier does not properly neutralize input, allowing OS command injection (CWE-78). An authenticated user can execute arbitrary commands on the appliance, which is a management component for QNAP NAS environments.

Impact

An attacker with valid credentials gains arbitrary command execution on the Q'center appliance, with high impact to confidentiality, integrity and availability of that host and potentially the NAS devices it manages.

Attack surface

Reachable over the network through the change password functionality; the CVSS vector (AV:N/PR:H/UI:N) indicates a network-reachable flaw requiring high privileges, i.e. an authenticated account, with no user interaction.

Exploitation

Public exploit code is referenced in multiple third-party advisories and Exploit-DB entries, and EPSS is high (0.592, ~99th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Q'center Virtual Appliance to a version later than 1.7.1063 per the QNAP security advisory.
• Restrict network access to the Q'center management interface to trusted administrative networks.
• Audit and minimize accounts with access to the change password function; enforce least privilege.
• Monitor the appliance for unexpected child processes or shell activity spawned by its web service.

Detection

• Review Q'center web and system logs for change password requests containing shell metacharacters.
• Alert on unexpected processes spawned by the Q'center web/application service.
• Hunt for outbound connections or command-and-control traffic originating from the Q'center appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.