What’s Vulnerable › Vulnerabilities
CVE-2020-36198: Command Injection Vulnerability in Malware Remover
- Severity: medium (CVSS 6.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-05-13 · updated 2026-06-17
- Weakness: CWE-77
Description
A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP Systems Inc. Malware Remover 3.x.
Affected products
- QNAP Systems Inc. Malware Remover: from 4.5.4.0 before 4.6.1.0 — fixed in 4.6.1.0
How to fix
Upgrade to a fixed version: QNAP Systems Inc. Malware Remover 4.6.1.0. Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.html
- https://www.qnap.com/zh-tw/security-advisory/qsa-21-16
- https://www.zerodayinitiative.com/advisories/ZDI-21-592/
- http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.html
- https://www.qnap.com/zh-tw/security-advisory/qsa-21-16
- https://www.zerodayinitiative.com/advisories/ZDI-21-592/
Get alerted when CVE-2020-36198 or the next vulnerability affects your stack