CVE-2024-32766

The vulnerability (CWE-77, CWE-78) consists of insufficient validation or neutralization of input data passed to the operating system command interpreter. An attacker can send a specially crafted request over the network containing malicious commands that will be executed in the context of the NAS device's operating system. The network attack vector (AV:N), lack of required privileges (PR:N), and absence of user interaction (UI:N) make the attack fully remote and automated.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary system commands on the QNAP NAS device, which can lead to complete device takeover, data breach, modification or destruction of data, as well as the use of the device as an entry point to the internal network (lateral movement).

Software must be immediately updated to the following versions: QTS 5.1.3.2578 build 20231110 or newer, QTS 4.5.4.2627 build 20231225 or newer, QuTS hero h5.1.3.2578 build 20231110 or newer, QuTS hero h4.5.4.2626 build 20231225 or newer, QuTScloud c5.1.5.2651 or newer. Additionally, it is recommended to restrict access to the device management panel exclusively to trusted IP addresses and disable direct internet access if not required.

QNAP QTS in versions prior to 5.1.3.2578 build 20231110 and prior to 4.5.4.2627 build 20231225; QuTS hero in versions prior to h5.1.3.2578 build 20231110 and prior to h4.5.4.2626 build 20231225; QuTScloud in versions prior to c5.1.5.2651