CVE-2014-5457
QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password.
- Score
- CVSS 2.0 2.1 Low
- Status
- Modified - cve@mitre.org
- Published
- 2014-08-25
- Last modified
- 2024-09-17
- Weaknesses
- CWE-264
Affected products
- Ss-839 (Qnap)
- Ss-839 Firmware (Qnap)
- Ts-459u (Qnap)
- Ts-459u Firmware (Qnap)
- Ts-469u (Qnap)
- Ts-469u Firmware (Qnap)
- Ts-ec1679u-rp (Qnap)
- Ts-ec1679u-rp Firmware (Qnap)
References
- http://seclists.org/fulldisclosure/2014/Jul/57
- http://seclists.org/fulldisclosure/2014/Jul/58
- http://seclists.org/fulldisclosure/2014/Jul/59
- http://seclists.org/fulldisclosure/2014/Jul/61
