Command Injection Vulnerability in QTS and QuTS hero
Priority CRITICAL 100Exploited in the wildCWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.
Summary
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
Why it matters now
Exploitation Active In CISA KEV since 2022-04-11CISA due date 2022-05-02
EPSS 0.33987 98th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123, 4.3.6.1620 Build 20210322 +3QuTS hero (QNAP Systems Inc.): h4.5.1.1491 build 20201119
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QNAP | QTS | before 4.5.2.1566 Build 20210202; before 4.5.1.1495 Build 20201123; before 4.3.6.1620 Build 20210322; before 4.3.4.1632 Build 20210324; before 4.3.3.1624 Build 20210416; before 4.2.6 Build 20210327 | 4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123, 4.3.6.1620 Build 20210322, 4.3.4.1632 Build 20210324, 4.3.3.1624 Build 20210416, 4.2.6 Build 20210327 | Patch available | CNA |
| QNAP | QuTS hero | before h4.5.1.1491 build 20201119 | h4.5.1.1491 build 20201119 | Patch available | CNA |
- QTS VendorQNAP Affected before 4.5.2.1566 Build 20210202; before 4.5.1.1495 Build 20201123; before 4.3.6.1620 Build 20210322; before 4.3.4.1632 Build 20210324; before 4.3.3.1624 Build 20210416; before 4.2.6 Build 20210327 Fixed in 4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123, 4.3.6.1620 Build 20210322, 4.3.4.1632 Build 20210324, 4.3.3.1624 Build 20210416, 4.2.6 Build 20210327 Patch available CNA
- QuTS hero VendorQNAP Affected before h4.5.1.1491 build 20201119 Fixed in h4.5.1.1491 build 20201119 Patch available CNA
CPE configurations NVD · 84
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* | before 4.2.6; 4.3.5 to before 4.3.6; 4.4.0 to before 4.5.1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:* | 4.2.6 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* | 4.2.6 build_20170517 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* | 4.2.6 build_20190322 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* | 4.2.6 build_20190730 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* | 4.2.6 build_20190921 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* | 4.2.6 build_20191107 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* | 4.2.6 build_20200109 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* | 4.2.6 build_20200421 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* | 4.2.6 build_20200611 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.2.6; 4.3.5 to before 4.3.6; 4.4.0 to before 4.5.1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
Show 74 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* | 4.2.6 build_20200821 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:* | 4.3.3.0174 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:* | 4.3.3.0868 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:* | 4.3.3.0998 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:* | 4.3.3.1051 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:* | 4.3.3.1098 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:* | 4.3.3.1161 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:* | 4.3.3.1252 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:* | 4.3.3.1315 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:* | 4.3.3.1386 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.3.1432:*:*:*:*:*:*:* | 4.3.3.1432 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0358:*:*:*:*:*:*:* | 4.3.4.0358 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:* | 4.3.4.0358 beta1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0370:*:*:*:*:*:*:* | 4.3.4.0370 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:* | 4.3.4.0370 beta1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0372:*:*:*:*:*:*:* | 4.3.4.0372 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:* | 4.3.4.0372 beta1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0374:*:*:*:*:*:*:* | 4.3.4.0374 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:* | 4.3.4.0374 beta1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0387:*:*:*:*:*:*:* | 4.3.4.0387 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:* | 4.3.4.0387 beta2 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0411:*:*:*:*:*:*:* | 4.3.4.0411 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0416:*:*:*:*:*:*:* | 4.3.4.0416 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0427:*:*:*:*:*:*:* | 4.3.4.0427 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0434:*:*:*:*:*:*:* | 4.3.4.0434 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0435:*:*:*:*:*:*:* | 4.3.4.0435 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0451:*:*:*:*:*:*:* | 4.3.4.0451 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0483:*:*:*:*:*:*:* | 4.3.4.0483 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0486:*:*:*:*:*:*:* | 4.3.4.0486 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0506:*:*:*:*:*:*:* | 4.3.4.0506 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0516:*:*:*:*:*:*:* | 4.3.4.0516 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0526:*:*:*:*:*:*:* | 4.3.4.0526 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0551:*:*:*:*:*:*:* | 4.3.4.0551 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0557:*:*:*:*:*:*:* | 4.3.4.0557 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0561:*:*:*:*:*:*:* | 4.3.4.0561 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0569:*:*:*:*:*:*:* | 4.3.4.0569 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0593:*:*:*:*:*:*:* | 4.3.4.0593 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0597:*:*:*:*:*:*:* | 4.3.4.0597 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0604:*:*:*:*:*:*:* | 4.3.4.0604 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:* | 4.3.4.0899 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:* | 4.3.4.1029 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.1082:*:*:*:*:*:*:* | 4.3.4.1082 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.1190:*:*:*:*:*:*:* | 4.3.4.1190 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.1282:*:*:*:*:*:*:* | 4.3.4.1282 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.1368:*:*:*:*:*:*:* | 4.3.4.1368 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.1417:*:*:*:*:*:*:* | 4.3.4.1417 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.4.1463:*:*:*:*:*:*:* | 4.3.4.1463 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:* | 4.3.6 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:* | 4.3.6.0895 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:* | 4.3.6.0907 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:* | 4.3.6.0923 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:* | 4.3.6.0944 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:* | 4.3.6.0959 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:* | 4.3.6.0979 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:* | 4.3.6.0993 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:* | 4.3.6.1013 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:* | 4.3.6.1033 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:* | 4.3.6.1070 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:* | 4.3.6.1154 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:* | 4.3.6.1218 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:* | 4.3.6.1263 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:* | 4.3.6.1286 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:* | 4.3.6.1333 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:* | 4.3.6.1411 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.3.6.1446:*:*:*:*:*:*:* | 4.3.6.1446 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.1:-:*:*:*:*:*:* | 4.5.1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.1.1456:*:*:*:*:*:*:* | 4.5.1.1456 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.1.1461:*:*:*:*:*:*:* | 4.5.1.1461 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.1.1465:*:*:*:*:*:*:* | 4.5.1.1465 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.1.1480:*:*:*:*:*:*:* | 4.5.1.1480 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:* | 4.5.2 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* | before h4.5.1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.1:-:*:*:*:*:*:* | h4.5.1 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.1.1472:*:*:*:*:*:*:* | h4.5.1.1472 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:* Versions 4.3.3.0174 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:* Versions 4.3.3.0868 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:* Versions 4.3.3.0998 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:* Versions 4.3.3.1051 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:* Versions 4.3.3.1098 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:* Versions 4.3.3.1161 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:* Versions 4.3.3.1252 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:* Versions 4.3.3.1315 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:* Versions 4.3.3.1386 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.3.1432:*:*:*:*:*:*:* Versions 4.3.3.1432 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0358:*:*:*:*:*:*:* Versions 4.3.4.0358 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0358:beta1:*:*:*:*:*:* Versions 4.3.4.0358 beta1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0370:*:*:*:*:*:*:* Versions 4.3.4.0370 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0370:beta1:*:*:*:*:*:* Versions 4.3.4.0370 beta1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0372:*:*:*:*:*:*:* Versions 4.3.4.0372 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0372:beta1:*:*:*:*:*:* Versions 4.3.4.0372 beta1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0374:*:*:*:*:*:*:* Versions 4.3.4.0374 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0374:beta1:*:*:*:*:*:* Versions 4.3.4.0374 beta1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0387:*:*:*:*:*:*:* Versions 4.3.4.0387 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0387:beta2:*:*:*:*:*:* Versions 4.3.4.0387 beta2 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0411:*:*:*:*:*:*:* Versions 4.3.4.0411 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0416:*:*:*:*:*:*:* Versions 4.3.4.0416 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0427:*:*:*:*:*:*:* Versions 4.3.4.0427 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0434:*:*:*:*:*:*:* Versions 4.3.4.0434 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0435:*:*:*:*:*:*:* Versions 4.3.4.0435 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0451:*:*:*:*:*:*:* Versions 4.3.4.0451 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0483:*:*:*:*:*:*:* Versions 4.3.4.0483 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0486:*:*:*:*:*:*:* Versions 4.3.4.0486 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0506:*:*:*:*:*:*:* Versions 4.3.4.0506 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0516:*:*:*:*:*:*:* Versions 4.3.4.0516 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0526:*:*:*:*:*:*:* Versions 4.3.4.0526 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0551:*:*:*:*:*:*:* Versions 4.3.4.0551 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0557:*:*:*:*:*:*:* Versions 4.3.4.0557 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0561:*:*:*:*:*:*:* Versions 4.3.4.0561 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0569:*:*:*:*:*:*:* Versions 4.3.4.0569 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0593:*:*:*:*:*:*:* Versions 4.3.4.0593 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0597:*:*:*:*:*:*:* Versions 4.3.4.0597 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0604:*:*:*:*:*:*:* Versions 4.3.4.0604 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:* Versions 4.3.4.0899 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:* Versions 4.3.4.1029 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.1082:*:*:*:*:*:*:* Versions 4.3.4.1082 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.1190:*:*:*:*:*:*:* Versions 4.3.4.1190 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.1282:*:*:*:*:*:*:* Versions 4.3.4.1282 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.1368:*:*:*:*:*:*:* Versions 4.3.4.1368 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.1417:*:*:*:*:*:*:* Versions 4.3.4.1417 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.4.1463:*:*:*:*:*:*:* Versions 4.3.4.1463 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:* Versions 4.3.6.0895 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:* Versions 4.3.6.0907 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:* Versions 4.3.6.0923 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:* Versions 4.3.6.0944 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:* Versions 4.3.6.0959 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:* Versions 4.3.6.0979 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:* Versions 4.3.6.0993 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:* Versions 4.3.6.1013 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:* Versions 4.3.6.1033 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:* Versions 4.3.6.1070 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:* Versions 4.3.6.1154 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:* Versions 4.3.6.1218 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:* Versions 4.3.6.1263 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:* Versions 4.3.6.1286 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:* Versions 4.3.6.1333 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:* Versions 4.3.6.1411 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.3.6.1446:*:*:*:*:*:*:* Versions 4.3.6.1446 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.1:-:*:*:*:*:*:* Versions 4.5.1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.1.1456:*:*:*:*:*:*:* Versions 4.5.1.1456 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.1.1461:*:*:*:*:*:*:* Versions 4.5.1.1461 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.1.1465:*:*:*:*:*:*:* Versions 4.5.1.1465 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.1.1480:*:*:*:*:*:*:* Versions 4.5.1.1480 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.2:-:*:*:*:*:*:* Versions 4.5.2 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions before h4.5.1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.1:-:*:*:*:*:*:* Versions h4.5.1 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.1.1472:*:*:*:*:*:*:* Versions h4.5.1.1472 Vulnerable ·QNAP
Remediation
- Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123, 4.3.6.1620 Build 20210322, 4.3.4.1632 Build 20210324, 4.3.3.1624 Build 20210416, 4.2.6 Build 20210327
- Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h4.5.1.1491 build 20201119
Timeline
- 2022-04-11 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2020-2509
- 2026-10-03 Alias added: GHSA-77jf-5mcg-g6m9
References
More QNAP Qts vulnerabilities
- TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
- TI-2018-14141 Cross-site scripting in QNAP QTS KEVCVSS 3.1MEDIUM 6.1
Sources
- CVE-2020-2509 · CVE Program
- CVE-2020-2509 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-77jf-5mcg-g6m9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences