QNAP Systems, Inc. has identified multiple high-severity vulnerabilities in its operating systems, potentially allowing attackers to compromise systems and execute malicious activities.
These issues affect several versions of QNAP’s QTS and QuTS hero operating systems. Users are urged to update their devices immediately to mitigate security risks. Below is an overview of the identified vulnerabilities:
Critical Vulnerabilities Reported
- CVE-2024-48859: Exploited via improper authentication, this vulnerability could allow remote attackers to compromise the system’s security.
- CVE-2024-48865: Improper certificate validation could enable attackers with local network access to breach the system’s security.
- CVE-2024-48866: Improper handling of URL encoding (hex encoding) could allow remote attackers to put the system in an unexpected state.
- CVE-2024-48867 and CVE-2024-48868: CRLF injection vulnerabilities in the system might enable remote attackers to alter application data.
- CVE-2024-50393: A command injection vulnerability could allow remote attackers to execute arbitrary commands on the system.
- CVE-2024-50402 and CVE-2024-50403: Exploitation of externally controlled format string vulnerabilities might allow attackers with administrator access to obtain sensitive data or modify memory.
Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar
Affected Products and Fixed Versions
QNAP has released patches for the affected versions to resolve these vulnerabilities. Ensure your system runs one of the fixed versions listed below:
| Affected Product | Fixed Version |
| QTS 5.1.x | QTS 5.1.9.2954 build 20241120 and later |
| QTS 5.2.x | QTS 5.2.2.2950 build 20241114 and later |
| QuTS hero h5.1.x | QuTS hero h5.1.9.2954 build 20241120 and later |
| QuTS hero h5.2.x | QuTS hero h5.2.2.2952 build 20241116 and later |
Recommendation for Mitigation
To safeguard your device, promptly update your operating system to the latest version. Follow these steps:
- Log in to QTS or QuTS hero as an administrator.
- Navigate to Control Panel > System > Firmware Update.
- Under Live Update, click Check for Update to download and install the latest firmware.
- Alternatively, visit the QNAP Support > Download Center to perform a manual update.
Proactively updating your system ensures protection against these high-severity threats. Regular firmware updates are essential for maintaining system security and stability.
Investigate Real-World Malicious Links,Malware & Phishing Attacks With ANY.RUN -Â Try for Free
