"Critical Vulnerability Allows Access to QNAP NAS Devices"

Taiwan-based QNAP Systems recently announced patches for multiple vulnerabilities impacting its products, including a critical severity bug leading to unauthenticated device access.  Tracked as CVE-2024-21899 (CVSS score of 9.8), the vulnerability is described as an improper authentication issue that "could allow users to compromise the security of the system via a network." According to the company, the issue impacts its QTS, QuTS hero, and QuTScloud products, essentially exposing network-attached storage (NAS) devices to unauthenticated access.  The flaw was addressed with the release of QTS 5.1.3.2578 build 20231110 and 4.5.4.2627 build 20231225, QuTS hero h5.1.3.2578 build 20231110 and h4.5.4.2626 build 20231225, and QuTScloud c5.1.5.2651.b QNAP also patched two other vulnerabilities addressed in QTS, QuTS hero, QuTScloud, and myQNAPcloud.  Tracked as CVE-2024-21900 and CVE-2024-21901, these are medium-severity issues leading to command execution or code injection over a network.  The company noted that both issues require authentication to be exploited, and CVE-2024-21901 requires administrator credentials.  QTS versions 4.5.4.2627 build 20231225 and 5.1.3.2578 build 20231110, QuTS hero version h5.1.3.2578 build 20231110, QuTScloud version c5.1.5.2651, and myQNAPcloud version 1.0.52 ( 2023/11/24 ) contain patches for these bugs.  Additionally, QNAP announced patches for several other medium-severity vulnerabilities in QuMagie Mobile, QTS, QuTS hero, QuTScloud, and Photo Station that could lead to code injection, command execution, and data leaks.  The company did not mention if these vulnerabilities are being exploited in attacks. 

SecurityWeek reports: "Critical Vulnerability Allows Access to QNAP NAS Devices"