Taiwan-based QNAP Systems over the weekend announced patches for multiple vulnerabilities impacting its products, including a critical-severity bug leading to unauthenticated device access.
Tracked as CVE-2024-21899 (CVSS score of 9.8), the vulnerability is described as an improper authentication issue that “could allow users to compromise the security of the system via a network”.
According to QNAP, the issue impacts its QTS, QuTS hero, and QuTScloud products, essentially exposing network-attached storage (NAS) devices to unauthenticated access.
The flaw was addressed with the release of QTS 5.1.3.2578 build 20231110 and 4.5.4.2627 build 20231225, QuTS hero h5.1.3.2578 build 20231110 and h4.5.4.2626 build 20231225, and QuTScloud c5.1.5.2651.
QNAP’s advisory also describes two other vulnerabilities addressed in QTS, QuTS hero, QuTScloud, and myQNAPcloud. Tracked as CVE-2024-21900 and CVE-2024-21901, these are medium-severity issues leading to command execution or code injection over a network.
Both issues require authentication to be exploited, and CVE-2024-21901 requires administrator credentials.
QTS versions 4.5.4.2627 build 20231225 and 5.1.3.2578 build 20231110, QuTS hero version h5.1.3.2578 build 20231110, QuTScloud version c5.1.5.2651, and myQNAPcloud version 1.0.52 ( 2023/11/24 ) contain patches for these bugs.
Additionally, QNAP announced patches for several other medium-severity vulnerabilities in QuMagie Mobile, QTS, QuTS hero, QuTScloud, and Photo Station that could lead to code injection, command execution, and data leaks.
QNAP makes no mention of any of these vulnerabilities being exploited in attacks. Additional information can be found on the company’s security advisories page.
QNAP is known for its NAS and professional network video recorder (NVR) products, but the Taiwanese company also produces various types of networking equipment.
Threat actors often exploit QNAP product vulnerabilities in their attacks.
Related: QNAP Patches High-Severity Bugs in QTS, Qsync Central
Related: QNAP Patches High-Severity Flaws in QTS, Video Station, QuMagie, Netatalk Products
Related: CISA Warns of FXC Router, QNAP NVR Vulnerabilities Exploited in the Wild
