Connect with us

Hi, what are you looking for?



Critical Vulnerability Allows Access to QNAP NAS Devices

Critical-severity vulnerability could allow network attackers to access QNAP NAS devices without authentication.

Taiwan-based QNAP Systems over the weekend announced patches for multiple vulnerabilities impacting its products, including a critical-severity bug leading to unauthenticated device access.

Tracked as CVE-2024-21899 (CVSS score of 9.8), the vulnerability is described as an improper authentication issue that “could allow users to compromise the security of the system via a network”.

According to QNAP, the issue impacts its QTS, QuTS hero, and QuTScloud products, essentially exposing network-attached storage (NAS) devices to unauthenticated access.

The flaw was addressed with the release of QTS build 20231110 and build 20231225, QuTS hero h5.1.3.2578 build 20231110 and h4.5.4.2626 build 20231225, and QuTScloud c5.1.5.2651.

QNAP’s advisory also describes two other vulnerabilities addressed in QTS, QuTS hero, QuTScloud, and myQNAPcloud. Tracked as CVE-2024-21900 and CVE-2024-21901, these are medium-severity issues leading to command execution or code injection over a network.

Both issues require authentication to be exploited, and CVE-2024-21901 requires administrator credentials.

QTS versions build 20231225 and build 20231110, QuTS hero version h5.1.3.2578 build 20231110, QuTScloud version c5.1.5.2651, and myQNAPcloud version 1.0.52 ( 2023/11/24 ) contain patches for these bugs.

Additionally, QNAP announced patches for several other medium-severity vulnerabilities in QuMagie Mobile, QTS, QuTS hero, QuTScloud, and Photo Station that could lead to code injection, command execution, and data leaks.

Advertisement. Scroll to continue reading.

QNAP makes no mention of any of these vulnerabilities being exploited in attacks. Additional information can be found on the company’s security advisories page.

QNAP is known for its NAS and professional network video recorder (NVR) products, but the Taiwanese company also produces various types of networking equipment.

Threat actors often exploit QNAP product vulnerabilities in their attacks.

Related: QNAP Patches High-Severity Bugs in QTS, Qsync Central

Related: QNAP Patches High-Severity Flaws in QTS, Video Station, QuMagie, Netatalk Products

Related: CISA Warns of FXC Router, QNAP NVR Vulnerabilities Exploited in the Wild

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Kim Larsen is new Chief Information Security Officer at Keepit

Professional services company Slalom has appointed Christopher Burger as its first CISO.

Allied Universal announced that Deanna Steele has joined the company as CIO for North America.

More People On The Move

Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.