CVE-2018-0706
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier...
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
- Record
CVE-2018-0706- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
- Record
CVE-2018-0706- Updated
- 2026-11-02
EUVDEUVD-2018-1516 No score
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
- Record
EUVD-2018-1516- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h99w-73g9-4qjx
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier...
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
- Record
GHSA-h99w-73g9-4qjx- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities | 2018-07-13 |
| Exploit-DB | QNAP Q'Center - 'change_passwd' Command Execution (Metasploit) | 2018-07-17 |
| Metasploit | QNAP Q'Center change_passwd Command Execution | 2018-07-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-0706 is a high vulnerability (CVSS 8.8) in Qnap Q'center Virtual Appliance, published July 16, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 48.3%, the 98th percentile. No source names a fixed version.
References
exploit-db.com/exploits/45015
coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities
seclists.org/fulldisclosure/2018/Jul/45
packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.html
qnap.com/zh-tw/security-advisory/nas-201807-10
securityfocus.com/archive/1/542141/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2018-0706
github.com/advisories/GHSA-h99w-73g9-4qjx