QNAP NAS devices under ransomware attack

QNAP Network-Attached Storage (NAS) devices contain a command injection vulnerability (CWE-77/CWE-78) in which unsanitized input is passed to an operating-system command shell, allowing remote attackers to run arbitrary commands. The flaw is reachable over the network through the NAS device's software interfaces, so an attacker who can reach a vulnerable device can trigger the injection and achieve remote code execution. Successful exploitation gives an attacker control of the NAS, including access to stored data and a potential foothold for lateral movement or ransomware, though CISA has not confirmed ransomware use in this case. Any organization running an affected QNAP NAS device is exposed, especially where the management interface is internet-facing; exact affected version ranges are not stated in the available data and should be taken from QNAP's security advisory. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-11, indicating exploitation has been observed in the wild, and its 33.4% EPSS score (98th percentile) signals elevated near-term exploitation risk, although no public PoC is known.

Do: Apply the vendor's firmware/OS updates per QNAP's security advisory, as this is the required action under CISA's KEV catalog. Until patched, remove direct internet exposure of NAS management interfaces and restrict access via firewall rules or VPN. Because exploitation has been observed in the wild, check NAS logs for unexpected commands, processes, or logins even after updating.

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later

CVE-2021-28799 is a critical improper authorization flaw (CWE-285, CVSS 9.8) in HBS 3 (Hybrid Backup Sync), the backup application bundled with QNAP NAS firmware. Because the weakness is reachable over the network with no privileges and no user interaction, a remote attacker who can reach an affected NAS can bypass authorization and log in to the device. An attacker gaining this unauthorized login obtains remote access to the NAS, which threat actors have leveraged in ransomware campaigns against QNAP devices. Anyone running HBS 3 on QTS 4.3.3, 4.3.4, 4.3.6 or 4.5.2, QuTS hero h4.5.1, or QuTScloud c4.5.1-c4.5.4 at versions below the listed fixes is affected, while HBS 2 and HBS 1.3 are not affected. The flaw is in the wild: it was added to CISA's KEV on 2022-03-31 with known ransomware use, EPSS puts 30-day exploitation probability at 78.3% (top percentile), and public reporting around this period describes ransomware waves (e.g., Qlocker, eCh0raix) infecting hundreds of QNAP NAS devices within days.

Do: Update HBS 3 to the fix for your OS: v16.0.0415 on QTS 4.5.2, v3.0.210412 on QTS 4.3.6, v3.0.210411 on QTS 4.3.4/4.3.3, and v16.0.0419 on QuTS hero h4.5.1 and QuTScloud c4.5.1~c4.5.4. Until patched, keep the NAS and its web services off the direct internet (disable router port forwarding/UPnP to the NAS) and review devices for signs of compromise. Given the KEV listing and known ransomware use, prioritize internet-reachable NAS devices.