This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] QNAP fixes 10 vulnerabilities

QNAP fixes 10 vulnerabilities in its products [1][2][3]. The most severe of them are described below; the remaining ones can be found at [1]. Products and their fixed versions: QTS - 5.1.9.2954 build 20241120 and 5.2.2.2950 build 20241114 [1] QuTS hero - h5.1.9.2954 build 20241120 and h5.2.2.2952 build 20241116 [1] License Center - 1.9.43 [2] Qsync Central - 4.4.0.16_20240819 (2024/08/19) [3]

QNAP QTS a QuTS hero - application data modification (CVE-2024-48868)
CVSS 8.8 (High)

An unauthenticated remote attacker can modify application data without authorization in the QTS and QuTS hero operating systems due to insufficient input validation [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 12. 2024.

QNAP QTS a QuTS hero - command execution (CVE-2024-50393)
CVSS 8.8 (High)

An unauthenticated remote attacker can execute arbitrary commands in the QTS and QuTS hero operating systems [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-50393 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 12. 2024.

QNAP QTS a QuTS hero - system security compromise (CVE-2024-48865)
CVSS 8.6 (High)

An unauthenticated local attacker can compromise system security in the QTS and QuTS hero operating systems due to insufficient certificate validation [1].

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 12. 2024.

QNAP License Center - OS command execution (CVE-2024-48863)
CVSS 8.8 (High)

An unauthenticated remote attacker can execute arbitrary commands in the machine's operating system due to a vulnerability in License Center [2].

The vulnerability is present in product:

  • License Center; >=1.9, <1.9.43;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 12. 2024.

QNAP Qsync Central - unauthorized access (CVE-2024-50404)
CVSS 5.7 (Medium)

An authenticated remote attacker who has obtained user access in Qsync Central can browse the application's file system by means of social engineering [3].

The vulnerability is present in product:

  • Qsync Central; >=4.4, <4.4.0.16_20240819;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 7. 12. 2024.

By CESNET, z.s.p.o. Michaela Ručková on 6. 1. 2025.

CESNET, z.s.p.o. Logo