(Pwn2Own) QNAP TS-464 Exposed Dangerous Method Privilege Escalation Vulnerability

2024-05-1900:00:00

Tri and Bien Pham (@bienpnn) from Team Orca of Sea Security

www.zerodayinitiative.com

pwn2own

qnap

ts-464

exposed dangerous method

privilege escalation

vulnerability

authentication

privwizard.cgi

arbitrary code

root

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.9%

JSON

This vulnerability allows remote attackers to escalate privileges on affected installations of QNAP TS-464 NAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privWizard.cgi endpoint. The issue results from an exposed dangerous method. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

References

www.qnap.com/en/security-advisory/qsa-24-09