{"containers": {"cna": {"affected": [{"product": "Video Station", "vendor": "QNAP Systems Inc.", "versions": [{"lessThan": "5.5.9", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "5.3.13", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "5.1.8", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Thomas Fady"}], "datePublic": "2022-05-06T00:00:00", "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 and later Video Station 5.3.13 and later Video Station 5.1.8 and later"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-05T16:50:27", "orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.qnap.com/en/security-advisory/qsa-22-14"}], "solutions": [{"lang": "en", "value": "We have already fixed this vulnerability in the following versions of Video Station:\nVideo Station 5.5.9 and later\nVideo Station 5.3.13 and later\nVideo Station 5.1.8 and later\n"}], "source": {"advisory": "QSA-22-14", "discovery": "EXTERNAL"}, "title": "Improper authentication in Video Station", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@qnap.com", "DATE_PUBLIC": "2022-05-06T00:00:00.000Z", "ID": "CVE-2021-44056", "STATE": "PUBLIC", "TITLE": "Improper authentication in Video Station"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Video Station", "version": {"version_data": [{"version_affected": "<", "version_value": "5.5.9"}, {"version_affected": "<", "version_value": "5.3.13"}, {"version_affected": "<", "version_value": "5.1.8"}]}}]}, "vendor_name": "QNAP Systems Inc."}]}}, "credit": [{"lang": "eng", "value": "Thomas Fady"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 and later Video Station 5.3.13 and later Video Station 5.1.8 and later"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-287"}]}]}, "references": {"reference_data": [{"name": "https://www.qnap.com/en/security-advisory/qsa-22-14", "refsource": "MISC", "url": "https://www.qnap.com/en/security-advisory/qsa-22-14"}]}, "solution": [{"lang": "en", "value": "We have already fixed this vulnerability in the following versions of Video Station:\nVideo Station 5.5.9 and later\nVideo Station 5.3.13 and later\nVideo Station 5.1.8 and later\n"}], "source": {"advisory": "QSA-22-14", "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "assignerShortName": "qnap", "cveId": "CVE-2021-44056", "datePublished": "2022-05-06T00:00:00", "dateReserved": "2021-11-19T00:00:00", "dateUpdated": "2022-05-05T16:50:27", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B1BA79E-C71B-4B2D-B38D-A65DC3806AFF", "versionEndExcluding": "5.1.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "00BC7664-9F03-4909-B4E5-95DCAC7869B1", "versionEndExcluding": "5.3.13", "versionStartIncluding": "5.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1042A67-6E5E-4B9D-912F-51FEC70A30FB", "versionEndExcluding": "5.5.9", "versionStartIncluding": "5.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 and later Video Station 5.3.13 and later Video Station 5.1.8 and later"}, {"lang": "es", "value": "Se ha informado de una vulnerabilidad de autenticaci\u00f3n inapropiada que afecta al dispositivo QNAP que ejecuta Video Station. Si es explotada, esta vulnerabilidad permite a atacantes comprometer la seguridad del sistema. Ya hemos corregido esta vulnerabilidad en las siguientes versiones de Video Station: Video Station 5.5.9 y posteriores Video Station 5.3.13 y posteriores Video Station 5.1.8 y posteriores"}], "id": "CVE-2021-44056", "lastModified": "2022-05-13T20:14:39.333", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security@qnapsecurity.com.tw", "type": "Secondary"}]}, "published": "2022-05-05T17:15:10.453", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/en/security-advisory/qsa-22-14"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@qnapsecurity.com.tw", "type": "Secondary"}]}

{}