Read the docs
TI-2020-18517 Aliases CVE-2020-36197GHSA-7mc6-7xwc-c4wg

Improper Access Control Vulnerability in Music Station

Priority MEDIUM 56CWE-284Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.3.16 on QTS 4.5.2; versions prior to 5.2.10 on QTS 4.3.6; versions prior to 5.1.14 on QTS 4.3.3; versions prior to 5.3.16 on QuTS hero h4.5.2; versions prior to 5.3.16 on QuTScloud c4.5.4.

Why it matters now

EPSS 0.18497 97th percentileScored 2026-11-07
Fix Fixed Music Station (QNAP Systems Inc.): 5.3.16, 5.2.10, 5.1.14

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPMusic Stationbefore 5.3.165.3.16Patch availableCNA
QNAPMusic Stationbefore 5.2.105.2.10Patch availableCNA
QNAPMusic Stationbefore 5.1.145.1.14Patch availableCNA
QNAPMusic Stationbefore 5.3.165.3.16Patch availableCNA
QNAPMusic Stationbefore 5.3.165.3.16Patch availableCNA
  • Music Station VendorQNAP Affected before 5.3.16 Fixed in 5.3.16 Patch available CNA
  • Music Station VendorQNAP Affected before 5.2.10 Fixed in 5.2.10 Patch available CNA
  • Music Station VendorQNAP Affected before 5.1.14 Fixed in 5.1.14 Patch available CNA
  • Music Station VendorQNAP Affected before 5.3.16 Fixed in 5.3.16 Patch available CNA
  • Music Station VendorQNAP Affected before 5.3.16 Fixed in 5.3.16 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*before 5.3.16VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:*4.5.2Running onQNAP
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*before 5.2.10VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*4.3.6Running onQNAP
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*before 5.1.14VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:-:*:*:*:*:*:*4.3.3Running onQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.2:*:*:*:*:*:*:*h4.5.2Running onQNAP
cpe:2.3:o:qnap:qutscloud:c4.5.4:*:*:*:*:*:*:*c4.5.4Running onQNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions before 5.3.16 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:* Versions 4.5.2 Running on ·QNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions before 5.2.10 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:* Versions 4.3.6 Running on ·QNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions before 5.1.14 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:-:*:*:*:*:*:* Versions 4.3.3 Running on ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.2:*:*:*:*:*:*:* Versions h4.5.2 Running on ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c4.5.4:*:*:*:*:*:*:* Versions c4.5.4 Running on ·QNAP

Remediation

  • Fix · CNA Music Station (QNAP Systems Inc.) Fixed in 5.3.16
  • Fix · CNA Music Station (QNAP Systems Inc.) Fixed in 5.2.10
  • Fix · CNA Music Station (QNAP Systems Inc.) Fixed in 5.1.14
  • Fix · CNA Music Station (QNAP Systems Inc.) Fixed in 5.3.16
  • Fix · CNA Music Station (QNAP Systems Inc.) Fixed in 5.3.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36197
  2. 2026-10-03 Alias added: GHSA-7mc6-7xwc-c4wg

References

Patch 1

Advisory 2

  • TI-2018-00678 Command injection in QNAP NAS devices CVSS 3.1CRITICAL 9.8
  • TI-2018-14138 Command injection in QNAP Music Station CVSS 3.1CRITICAL 9.8
  • TI-2018-00671 Command injection in QNAP Music Station CVSS 3.0CRITICAL 9.8
  • TI-2017-09711 QNAP discovered a number of command injection vulnerabilities found in Music Station… CVSS 3.0CRITICAL 9.8
  • TI-2023-24086 Improper authentication in QNAP Music Station CVSS 3.1HIGH 8.8
  • TI-2023-20443 Path traversal in QNAP Music Station CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences