QNAP fixed eight flaws that could allow NAS devices takeover
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-2491 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later NVD description · AI analysis pending | 6.1 | <1% |
| — | ||
| CVE-2020-2493 | This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later. NVD description · AI analysis pending | 6.1 | <1% |
| — | ||
| CVE-2020-2495 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QANP have already fixed these vulnerabilities in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later QTS 4.3.6.1333 build 20200608 and later QTS 4.3.4.1368 build 20200703 and later QTS 4.3.3.1315 build 20200611 and later QTS 4.2.6 build 20200611 and later NVD description · AI analysis pending | 6.1 | 1% |
| — |
Full article314 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 08, 2020
Network-attached storage (NAS) vendor QNAP addressed vulnerabilities that could enable attackers to take over unpatched NAS devices.
The Taiwanese vendor QNAP has released security updates to fix eight vulnerabilities that could be exploited by attackers to over unpatched NAS devices.
The list of vulnerabilities addressed by QNAP is available here, it includes XSS and command injection issues. The flaws fixed by the vendor are rated as medium and high severity security.
The high-severity vulnerabilities tracked as CVE-2020-2495, CVE-2020-2496, CVE-2020-2497, and CVE-2020-2498 are cross-side-scripting flaws that could allow remote attackers to inject malicious code in File Station, to inject malicious code in System Connection Logs, and to inject malicious code in certificate configuration.
Other high severity issues fixed by the vendor are:
- CVE-2020-2493 – Cross-site Scripting Vulnerability in Multimedia Console
- CVE-2020-2491 – Cross-site Scripting Vulnerability in Photo Station
The Taiwanese vendor released security updates for QNAP QuTS hero high-performance ZFS-based operating system and the QTS NAS OS.
Customers have to apply the security updates as soon as possible to prevent their devices from being compromised.
In October, the vendor published an advisory to warn customers that certain versions of its NAS OS (QTS) are affected by the Zerologon vulnerability.
In October, QNAP also addressed two critical security vulnerabilities in the Helpdesk app that can potentially allow threat actors to take over the vulnerable QNAP network-attached storage (NAS) devices.
In September, while the AgeLocker ransomware was continuing to target QNAP NAS systems, the Taiwanese vendor urged customers to update the firmware and apps.
In early August, the Taiwanese company urged its users to update the Malware Remover app to prevent NAS devices from being infected by the QSnatch malware.
In June the company also warned of eCh0raix ransomware attacks that targeted its NAS devices.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, NAS)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/112041/security/qnap-nas-flaws.html