CVE Vulnerability Advisory Database

[Affected Scope] All firmware versions of legacy D-Link NAS models DNS-320L, DNS-325, DNS-327L, and DNS-340L.

[Impact] Remote unauthenticated attackers can bypass authentication using hard-coded credentials, leading to complete system compromise and arbitrary code execution.

[Mitigation] Since these devices are End-of-Life (EOL) and will not receive security patches, they must be immediately decommissioned and replaced.

[Affected Scope] Zyxel NAS326 (prior to V5.21(AAZF.14)C0), NAS540 (prior to V5.21(AATB.11)C0), and NAS542 (prior to V5.21(ABAG.11)C0)

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges by sending crafted HTTP requests, leading to complete system compromise

[Mitigation] Apply the official firmware updates immediately and restrict external internet access to the NAS management interface

[Affected Scope] TerraMaster NAS devices running TOS (TerraMaster Operating System) version 4.2.29 and earlier

[Impact] Unauthenticated remote attackers can retrieve the administrator password hash or plaintext by sending a crafted HTTP request, leading to complete device compromise

[Mitigation] Immediately upgrade TOS to the latest secure version (4.2.30 or higher) and restrict external internet access to the NAS management interface

[Affected Scope] QNAP Photo Station running on QTS 5.0.1, 5.0.0, 4.5.x, 4.3.6, 4.3.3, and 4.2.6

[Impact] Unauthenticated remote attackers can modify critical system files, potentially leading to complete device compromise

[Mitigation] Immediately update Photo Station to the patched versions (6.1.2, 6.0.22, 5.7.18, 5.4.15, 5.2.14 or later)

[Affected Scope] QNAP QTS (prior to 4.5.2, 4.5.1, 4.3.6, 4.3.4, 4.3.3, 4.2.6) and QuTS hero (prior to h4.5.1)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges on the compromised NAS device

[Mitigation] Immediately upgrade QNAP firmware to the patched versions and restrict external internet access to the NAS management interface

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Remote attackers can inject malicious scripts into the web console, potentially leading to session hijacking or unauthorized administrative actions

[Mitigation] Immediately upgrade QTS to the patched versions recommended by QNAP and restrict external access to the management interface

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the target NAS device, leading to complete system compromise

[Mitigation] Immediately upgrade QTS to the latest patched firmware version and restrict external internet access to the NAS management interface

[Affected Scope] QNAP NAS devices running QTS versions prior to 4.4.2.1270, 4.4.1.1261, 4.3.6.1263, 4.3.4.1282, 4.3.3.1252, and 4.2.6

[Impact] Remote authenticated attackers can inject malicious scripts, potentially leading to session hijacking, administrative privilege escalation, and unauthorized device control

[Mitigation] Immediately upgrade QTS firmware to the recommended patched versions and restrict external access to the NAS management interface

[Affected Scope] QNAP Photo Station versions and associated QTS operating system environments

[Impact] Unauthenticated remote attackers can access or modify critical system files, potentially leading to full Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station to the latest secure version and restrict external access

[Affected Scope] QNAP Photo Station and QTS specific versions

[Impact] Unauthenticated remote attackers can access/modify system files and execute arbitrary commands, leading to full system compromise

[Mitigation] Immediately update Photo Station and QTS firmware to the latest recommended security patch versions

[Affected Scope] QNAP Photo Station versions running on QTS operating system environments

[Impact] Unauthenticated remote attackers can bypass access control mechanisms to gain unauthorized system access, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station and QTS to the latest official security-patched versions

[Affected Scope] D-Link ShareCenter DNS-320 NAS devices running firmware versions up to and including 2.05.B10

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted HTTP requests.

[Mitigation] Immediately restrict external internet access to the device and replace the legacy/EoL hardware with a supported model.