QNAP NAS Multiple Vulnerabilities
Release Date: 23 May 2024
RISK: Medium Risk
TYPE: Servers - Other Servers
Multiple vulnerabilities were identified in QNAP NAS. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, security restriction bypass, sensitive information disclosure and data manipulation on the targeted system.
Note:
Proof of concept exploit for CVE-2024-27130 exists on the internet. CVE-2024-27130 required an authenticated user to execute arbitrary code via a network. Hence, the overall risk level is medium.
Impact
- Remote Code Execution
- Security Restriction Bypass
- Information Disclosure
- Data Manipulation
System / Technologies affected
- QTS 5.1.7.2770 version prior to build 20240520
- QuTS hero h5.1.7.2770 version prior to build 20240520
Solutions
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
沒有留言:
發佈留言