QNAP Releases Firmware Patches for 9 New Flaws Affecting NAS Devices
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-44051 | A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later NVD description · AI analysis pending | 8.8 group max | 2% |
| — | ||
| CVE-2021-44055 +1 in the same advisory: …44056 | An missing authorization vulnerability has been reported to affect QNAP device running Video Station. An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers to access data or perform actions that they should not be allowed to perform. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later NVD description · AI analysis pending | 9.8 | 1% |
| — | ||
| CVE-2021-44057 | An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.20 ( 2022/02/15 ) and later Photo Station 5.7.16 ( 2022/02/11 ) and later Photo Station 5.4.13 ( 2022/02/11 ) and later NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2022-27588 | We have already fixed this vulnerability in the following versions of QVR: We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later NVD description · AI analysis pending | 9.8 | 1% |
| — |
Full article336 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 07, 2022
QNAP, Taiwanese maker of network-attached storage (NAS) devices, on Friday released security updates to patch nine security weaknesses, including a critical issue that could be exploited to take over an affected system.
"A vulnerability has been reported to affect QNAP VS Series NVR running QVR," QNAP said in an advisory. "If exploited, this vulnerability allows remote attackers to run arbitrary commands."
Tracked as CVE-2022-27588 (CVSS score: 9.8), the vulnerability has been addressed in QVR 5.1.6 build 20220401 and later. Credited with reporting the flaw is the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC).
Aside from the critical shortcoming, QNAP has also resolved three high-severity and five medium-severity bugs in its software -
- CVE-2021-38693 (CVSS score: 5.3) - A path traversal vulnerability in thttpd affecting QNAP devices running QTS, QuTS hero, QuTScloud, and QVR Pro Appliance, leading to information disclosure
- CVE-2021-44051 (CVSS score: 8.8) - A command injection vulnerability in QNAP devices running QTS, QuTS hero, and QuTScloud, resulting in arbitrary command execution
- CVE-2021-44052 (CVSS score: 6.5) - An improper link resolution before file access ("link following") vulnerability in QNAP devices running QTS, QuTS hero, and QuTScloud, allowing attackers to read/write files in arbitrary file locations
- CVE-2021-44053 (CVSS score: 5.7) - A cross-site scripting (XSS) vulnerability in QNAP devices running QTS, QuTS hero, and QuTScloud, leading to code injection
- CVE-2021-44054 (CVSS score: 4.3) - An open redirect vulnerability in QNAP devices running QTS, QuTS hero, and QuTScloud, making it possible to redirect users to rogue web pages
- CVE-2021-44055 (CVSS score: 5.3) - A missing authorization vulnerability in QNAP devices running Video Station, allowing attackers to access data or perform unauthorized actions
- CVE-2021-44056 (CVSS score: 7.1) - An improper authentication vulnerability in QNAP devices running Video Station, leading to system compromise
- CVE-2021-44057 (CVSS score: 7.1) - An improper authentication vulnerability in QNAP devices running Photo Station, leading to system compromise
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/05/qnap-releases-firmware-patches-for-9.html