Vulnerabilities fixed in QNAP operating systems

🗓️ 09 Dec 2024 13:36:33Reported by NCSCType

QNAP fixed improper authentication, certificate validation, URL encryption, carriage return injection and command injection; update to later OS versions.

Reporter	Title	Published	Views	Family All 91
BDU FSTEC	The vulnerability of the QuTS operating systems and QTS network devices from Qnap arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.	9 Dec 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of the QuTS operating systems and QTS network devices from Qnap are related to deficiencies in authentication procedures, allowing attackers to compromise the target system.	20 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to the failure to eliminate CRLF sequences, allows attackers to execute arbitrary code.	20 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to improper handling of data with URL encoding, allows attackers to execute arbitrary code.	20 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to the failure to eliminate CRLF sequences, allows attackers to execute arbitrary code.	20 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the QuTS operating systems and QTS network devices allows unauthorized access to protected information with root privileges, due to insufficient handling of format lines.	27 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the QuTS operating systems and QTS network devices allows unauthorized access to protected information with root privileges, due to insufficient handling of format lines.	27 Jan 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of the QuTS operating systems and QTS network devices from Qnap are related to errors in the certificate validation process, which allow attackers to trigger service interruptions.	27 Jan 202500:00	–	bdu_fstec
Circl	CVE-2024-48859	6 Dec 202416:36	–	circl
Circl	CVE-2024-48865	6 Dec 202418:58	–	circl

Source	Link
qnap	www.qnap.com/en/security-advisory/qsa-24-49

09 Dec 2024 13:36Current

8.3High risk

Vulners AI Score8.3

CVSS 48.7

EPSS0.04221

SSVC