If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HQnap Qts
OSQnap4.2.64.3.1.0013 – 4.3.3.1161 (bez)4.3.4 – 4.3.4.1190 (bez)< 4.2.64.4.0 – 4.4.1.1201 (bez)4.4.2 – 4.4.2.1231 (bez)4.3.6 – 4.3.6.1218 (bez)
CISA KEV — detailsi
- Vendori
- QNAP
- Producti
- Network Attached Storage (NAS)
- Added to KEVi
- May 24, 2022
- Remediation deadline (US Federal)i
- June 14, 2022(overdue)
- Ransomwarei
- Active ransomware campaigns exploit this vulnerability
Apply updates per vendor instructions.
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
Related vulnerabilities
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Ph...
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync...
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerabil...
This external control of file name or path vulnerability allows remote attackers to access or modify system fi...
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. ...