QNAP fixes 2 critical and 1 high-severity vulnerability

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] QNAP fixes 2 critical and 1 high-severity vulnerability

QNAP is fixing 2 critical and 1 high-severity vulnerability in QNAP OS (QTS, QuTS hero, QuTScloud) and myQNAPcloud [1]. The fixed versions listed below also fix vulnerabilities CVE-2024-21899, CVE-2024-21900 and CVE-2024-21901, about which we have already informed you. Products and their fixed versions [1]: QTS - 5.1.3.2578 build 20231110, 4.5.4.2627 build 20231225 QuTS hero - h5.1.3.2578 build 20231110, h4.5.4.2626 build 20231225 QuTScloud - c5.1.5.2651 myQNAPcloud - 2.4.51

QNAP OS - OS command injection (CVE-2024-27124)

CVSS 7.5 (High)

An unauthenticated remote attacker can execute operating system commands without authorization in QTS, QuTS hero and QuTScloud [2].

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

CVE-2024-27124 at cve.org, NVD
CWE-78 at cwe.mitre.org

The vulnerability was publicly disclosed 26. 4. 2024.

myQNAPcloud Link - missing authentication (CVE-2024-32764)

CVSS 9.9 (Critical)

An unauthenticated remote attacker can make unauthorized use of a critical function in myQNAPcloud Link [3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

More information:

CVE-2024-32764 at cve.org, NVD
CWE-306 at cwe.mitre.org
CWE-346 at cwe.mitre.org
CWE-749 at cwe.mitre.org

The vulnerability was publicly disclosed 26. 4. 2024.

QNAP OS - OS command injection (CVE-2024-32766)

CVSS 10.0 (Critical)

An unauthenticated remote attacker can run commands in the operating system of QTS, QuTS hero and QuTScloud without authorization [4].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2024-32766 at cve.org, NVD
CWE-78 at cwe.mitre.org

The vulnerability was publicly disclosed 26. 4. 2024.

Links

By CESNET, z.s.p.o. Martin Krajči on 29. 4. 2024.

Report feedback

[TLP:CLEAR] QNAP fixes 2 critical and 1 high-severity vulnerability

QNAP OS - OS command injection (CVE-2024-27124)

CVSS 7.5 (High)

myQNAPcloud Link - missing authentication (CVE-2024-32764)

CVSS 9.9 (Critical)

QNAP OS - OS command injection (CVE-2024-32766)

CVSS 10.0 (Critical)

Links