All vulnerabilities
CVE-2020-2509

QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

QNAP QNAP Network-Attached Storage (NAS)Network & edge
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 11 Apr 2022CISA KEV
Exploit odds (EPSS)34.0%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.2.1566 Build 20210202Also 4.5.1.1495 Build 20201123, 4.3.6.1620 Build 20210322 and 3 moreCVE List
Federal deadline2 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Apr 2021, 03:50 UTCPublishedCVE List
  2. 11 Apr 2022Added to CISA KEVCISA KEV

Description

QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.

Text from CVE List

Affected versions 7

  • QTSaffected: unspecified before 4.5.2.1566 Build 20210202CVE List
  • QTSaffected: unspecified before 4.5.1.1495 Build 20201123CVE List
  • QTSaffected: unspecified before 4.3.6.1620 Build 20210322CVE List
  • QTSaffected: unspecified before 4.3.4.1632 Build 20210324CVE List
  • QTSaffected: unspecified before 4.3.3.1624 Build 20210416CVE List
  • QTSaffected: unspecified before 4.2.6 Build 20210327CVE List
  • QuTS heroaffected: unspecified before h4.5.1.1491 build 20201119CVE List

References 3