What’s Vulnerable › Vulnerabilities

CVE-2014-5457

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-08-25 · updated 2026-06-17
• Weakness: CWE-264

Description

QNAP TS-469U with firmware 4.0.7 Build 20140410, TS-459U, TS-EC1679U-RP, and SS-839 use world-readable permissions for /etc/config/shadow, which allows local users to obtain usernames and hashed passwords by reading the password.

Affected products

• QNAP Ss-839: all versions
• QNAP Ss-839 Firmware: 4.0.7
• QNAP Ts-459U: all versions
• QNAP Ts-459U Firmware: 4.0.7
• QNAP Ts-469U: all versions
• QNAP Ts-469U Firmware: 4.0.7
• QNAP Ts-Ec1679U-Rp: all versions
• QNAP Ts-Ec1679U-Rp Firmware: 4.0.7

References

• http://seclists.org/fulldisclosure/2014/Jul/57
• http://seclists.org/fulldisclosure/2014/Jul/58
• http://seclists.org/fulldisclosure/2014/Jul/59
• http://seclists.org/fulldisclosure/2014/Jul/61
• http://seclists.org/fulldisclosure/2014/Jul/57
• http://seclists.org/fulldisclosure/2014/Jul/58
• http://seclists.org/fulldisclosure/2014/Jul/59
• http://seclists.org/fulldisclosure/2014/Jul/61

Get alerted when CVE-2014-5457 or the next vulnerability affects your stack