CVE-2024-32764

The vulnerability results from the lack of a required authentication mechanism when accessing specific critical functions of the myQNAPcloud Link application. An attacker can, without possessing any credentials, invoke these functions over the network. The associated CWE vectors also indicate issues with request source verification (CWE-346) and exposure of functions that should be inaccessible from the outside (CWE-749). The broad scope of impact (Scope: Changed) suggests that exploitation may affect resources beyond the application itself.

An attacker can gain unauthorized access to protected application functions, which may lead to data modification or deletion (high integrity impact), as well as partial information disclosure (low confidentiality impact) and service availability degradation.

Update myQNAPcloud Link to version 2.4.51 or later. A patch is available from the vendor — details in QNAP security bulletin QSA-24-09 at https://www.qnap.com/en/security-advisory/qsa-24-09

QNAP myQNAPcloud Link — all versions prior to 2.4.51