Read the docs
TI-2024-33827 Aliases CVE-2024-50394GHSA-9973-9x4h-pfgx

Improper certificate validation in QNAP Helpdesk

Priority LOW 35CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: Helpdesk 3.3.3 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00307 23rd percentileScored 2026-11-07
Fix Fixed Helpdesk (QNAP Systems Inc.): 3.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPHelpdesk3.3.x to before 3.3.33.3.3Patch availableCNA
  • Helpdesk VendorQNAP Affected 3.3.x to before 3.3.3 Fixed in 3.3.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:qnap:helpdesk:*:*:*:*:*:*:*:*3.3.1 to before 3.3.3VulnerableQNAP
  • cpe:2.3:a:qnap:helpdesk:*:*:*:*:*:*:*:* Versions 3.3.1 to before 3.3.3 Vulnerable ·QNAP

Remediation

  • Fix · CNA Helpdesk (QNAP Systems Inc.) Fixed in 3.3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-50394
  2. 2026-10-03 Alias added: GHSA-9973-9x4h-pfgx

References

Advisory 1

  • TI-2020-02218 improper access control vulnerability in Helpdesk KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-02219 command injection vulnerability in Helpdesk CVSS 3.1CRITICAL 9.8
  • TI-2018-00668 Command injection in QNAP Helpdesk in QTS CVSS 3.0CRITICAL 9.8
  • TI-2020-02212 Improper access control in QNAP Helpdesk CVSS 3.1CRITICAL 9.8
  • TI-2021-09805 Improper Access Control Vulnerability in Helpdesk CVSS 3.1HIGH 8.8
  • TI-2018-00677 Improper privilege management in QNAP NAS devices CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences