QNAP Vulnerabilities and Affected Products
Vulnerabilities associated with Network Attached Storage (NAS).
Products
Clear product- qts38 vulnerabilities
- quts_hero27 vulnerabilities
- Photo Station8 vulnerabilities
- qutscloud8 vulnerabilities
- Q'center Virtual Appliance7 vulnerabilities
- QNAP Network-Attached Storage (NAS)5 vulnerabilities
- Network Attached Storage (NAS)4 vulnerabilities
- notes_station_34 vulnerabilities
- QNAP Media Streaming Add-On4 vulnerabilities
- QNAP QTS4 vulnerabilities
- media_streaming_add-on3 vulnerabilities
- qurouter3 vulnerabilities
- Helpdesk2 vulnerabilities
- malware_remover2 vulnerabilities
- music_station2 vulnerabilities
- QTS Login function2 vulnerabilities
- QTS Password function2 vulnerabilities
- qufirewall2 vulnerabilities
- ai_core1 vulnerability
- App Center in QTS1 vulnerability
- container_station1 vulnerability
- hbs_31 vulnerability
- Helpdesk in QTS1 vulnerability
- iartist_lite1 vulnerability
- LDAP Server in QTS1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-28799CRITICAL | Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScl… | CVSS10.0v3.1 | EPSS78.3% | PoCs0 | SignalsListed in CISA KEVKnown ransomware use1 Nuclei template | STIX |
CVE-2018-19949CRITICAL | QNAP NAS File Station Command Injection VulnerabilityIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109. | CVSS9.8v3.1 | EPSS24.4% | PoCs0 | SignalsListed in CISA KEVKnown ransomware useNo Nuclei templates | STIX |
CVE-2018-19953MEDIUM | QNAP NAS File Station Cross-Site Scripting VulnerabilityIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109. | CVSS6.1v3.1 | EPSS23.9% | PoCs0 | SignalsListed in CISA KEVKnown ransomware useNo Nuclei templates | STIX |
CVE-2018-19943HIGH | QNAP NAS File Station Cross-Site Scripting VulnerabilityIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later | CVSS8.0v3.1 | EPSS17.7% | PoCs0 | SignalsListed in CISA KEVKnown ransomware useNo Nuclei templates | STIX |