VDB
CVE-2024-38644
CVE-2024-38644
PUBLISHED
CVSS 8.699999809265137 HIGH
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to execute commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
EPSS 1.76% · 83.0th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
1.76%
83.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| qnap | notes_station_3 | 3.9.0 |
| QNAP Systems Inc. | Notes Station 3 | 3.9.x |
| qnap | notes_station_3 | 3.9.0 |
Timeline
- Nov 22, 2024 CVE Published
- Nov 22, 2024 CVE Updated
- Nov 23, 2024 EPSS Score
- Nov 26, 2024 PoC Published
- Dec 7, 2024 Coalition ESS Score
- Dec 11, 2024 EPSS Score
- Jan 15, 2025 EPSS Score
- Feb 1, 2025 EPSS Score
- Feb 19, 2025 EPSS Score
- Mar 8, 2025 EPSS Score
- Mar 25, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
References
- https://www.qnap.com/go/security-advisory/qsa-24-44 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-36 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-37 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-39 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-47 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-40 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-46 advisory
- https://www.qnap.com/go/security-advisory/qsa-24-43 advisory
- https://www.qnap.com/en/security-advisory/qsa-24-36 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-38644 advisory