Taiwan-based QNAP Systems on Friday warned users of an increase in attacks targeting network-attached storage (NAS) appliances, urging them to secure their devices as soon as possible.
The NAS and professional network video recorder (NVR) solutions manufacturer, which periodically issues alerts on attacks targeting its users, says that devices exposed to the Internet are at risk the most.
Networking devices, the company says, are constant targets for ransomware and brute-force attacks, and users should make sure they keep their devices protected if exposed to the Internet.
“QNAP urges all QNAP NAS users to follow the security setting instructions below to ensure the security of QNAP networking devices,” the manufacturer says.
For NAS devices exposed to the Internet, users should make sure port forwarding is disabled in their routers, and that the UPnP function is disabled on the NAS device.
QNAP last week also announced that it recently addressed a vulnerability affecting QNAP NAS running QVPN Service 3.x that can be exploited to achieve arbitrary code execution on the system.
The bug was addressed with the release of QVPN Service 3.0.760 a couple of weeks ago and users are advised to update to the patched release as soon as possible.
Additionally, the company announced the release of patches for a reflected cross-site scripting (XSS) bug in the TFTP Server in QTS, QuTS hero, and QuTScloud. Successful exploitation of the security error could allow an attacker to inject malicious code, QNAP says.
The issue was addressed with the release of QTS 4.5.4.1787 build 20210910, QuTS hero h4.5.4.1771 build 20210825, and QuTScloud c4.5.7.1864.
“To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes,” QNAP says.
Related: QNAP Warns of New Crypto-Mining Malware Targeting NAS Devices
Related: QNAP Patches Critical Vulnerabilities in QVR Software
Related: QNAP Urges Users to Secure Devices Against Brute-Force Attacks
More from Ionut Arghire
- Hackers Earn Over $1 Million at Pwn2Own Exploit Contest
- GoAnywhere Zero-Day Attack Hits Major Orgs
- Australia Dismantles BEC Group That Laundered $1.7 Million
- GitHub Rotates Publicly Exposed RSA SSH Private Key
- GitHub Suspends Repository Containing Leaked Twitter Source Code
- Google Ventures Leads $16 Million Investment in Dope.security
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
Latest News
- Microsoft: No-Interaction Outlook Zero Day Exploited Since Last April
- US to Adopt New Restrictions on Using Commercial Spyware
- Hackers Earn Over $1 Million at Pwn2Own Exploit Contest
- GoAnywhere Zero-Day Attack Hits Major Orgs
- Australia Dismantles BEC Group That Laundered $1.7 Million
- ‘Grim’ Criminal Abuse of ChatGPT is Coming, Europol Warns
- Webinar Tomorrow: Understanding Hidden Third-Party Identity Access Risks
- GitHub Rotates Publicly Exposed RSA SSH Private Key
