(Pwn2Own) QNAP TS-464 QR Code Device CRLF Injection Arbitrary Configuration Change Vulnerability

🗓️ 19 May 2024 00:00:00Reported by LJP (@ljp_tw) and YingMuo (@YingMuo), working with DEVCORE Internship ProgramType

zdi🔗 www.zerodayinitiative.com👁 47 Views

QNAP TS-464 QR Code Device CRLF Injection Arbitrary Configuration Change Vulnerability allows remote attackers to make arbitrary changes to configuration on affected installations of QNAP TS-464 NAS devices. Authentication is not required to exploit this vulnerability.

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the QTS, QuTS Hero, QuTScloud, and myQNAPcloud operating systems lies in the lack of authentication procedures, which allow attackers to gain full access to devices controlled by the vulnerable operating system.	11 Mar 202400:00	–	bdu_fstec
Circl	CVE-2024-21899	8 Mar 202418:26	–	circl
CNNVD	QNAP Systems Multiple Product Licensing Issues Vulnerabilities	8 Mar 202400:00	–	cnnvd
CVE	CVE-2024-21899	8 Mar 202416:17	–	cve
Cvelist	CVE-2024-21899 QTS, QuTS hero, QuTScloud	8 Mar 202416:17	–	cvelist
NVD	CVE-2024-21899	8 Mar 202417:15	–	nvd
OpenVAS	QNAP QTS Multiple Vulnerabilities (QSA-24-09)	12 Mar 202400:00	–	openvas
OpenVAS	QNAP QuTS hero Multiple Vulnerabilities (QSA-24-09)	11 Mar 202400:00	–	openvas
OpenVAS	QNAP QuTScloud Multiple Vulnerabilities (QSA-24-09)	12 Mar 202400:00	–	openvas
OSV	CVE-2024-21899	8 Mar 202417:15	–	osv