CVE Vulnerability Advisory Database

[Affected Scope] QNAP Photo Station running on QTS 5.0.1, 5.0.0, 4.5.x, 4.3.6, 4.3.3, and 4.2.6

[Impact] Unauthenticated remote attackers can modify critical system files, potentially leading to complete device compromise

[Mitigation] Immediately update Photo Station to the patched versions (6.1.2, 6.0.22, 5.7.18, 5.4.15, 5.2.14 or later)

[Affected Scope] QNAP HBS 3 (Hybrid Backup Sync) running on QTS, QuTS hero, and QuTScloud operating systems

[Impact] Unauthenticated remote attackers can exploit improper authorization to log in to the device with administrative privileges, potentially leading to full system compromise

[Mitigation] Immediately update HBS 3 to the patched versions and restrict external internet access to the NAS management interface

[Affected Scope] QNAP QTS (prior to 4.5.2, 4.5.1, 4.3.6, 4.3.4, 4.3.3, 4.2.6) and QuTS hero (prior to h4.5.1)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with elevated privileges on the compromised NAS device

[Mitigation] Immediately upgrade QNAP firmware to the patched versions and restrict external internet access to the NAS management interface

[Affected Scope] QNAP QTS operating system and Helpdesk application versions prior to 3.0.3

[Impact] Unauthenticated remote attackers can exploit improper access control to gain elevated privileges or read sensitive system information

[Mitigation] Immediately update the QTS operating system and upgrade the Helpdesk application to version 3.0.3 or later

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Remote attackers can inject malicious scripts into the web console, potentially leading to session hijacking or unauthorized administrative actions

[Mitigation] Immediately upgrade QTS to the patched versions recommended by QNAP and restrict external access to the management interface

[Affected Scope] QNAP QTS versions prior to 4.4.2.1231 Build 20200302, 4.4.1.1201 Build 20200130, 4.3.6.1218 Build 20200214, 4.3.4.1190 Build 20200107, 4.3.3.1161 Build 20200109, and 4.2.6 Build 20200109

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the target NAS device, leading to complete system compromise

[Mitigation] Immediately upgrade QTS to the latest patched firmware version and restrict external internet access to the NAS management interface

[Affected Scope] QNAP NAS devices running QTS versions prior to 4.4.2.1270, 4.4.1.1261, 4.3.6.1263, 4.3.4.1282, 4.3.3.1252, and 4.2.6

[Impact] Remote authenticated attackers can inject malicious scripts, potentially leading to session hijacking, administrative privilege escalation, and unauthorized device control

[Mitigation] Immediately upgrade QTS firmware to the recommended patched versions and restrict external access to the NAS management interface

[Affected Scope] QNAP Photo Station versions and associated QTS operating system environments

[Impact] Unauthenticated remote attackers can access or modify critical system files, potentially leading to full Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station to the latest secure version and restrict external access

[Affected Scope] QNAP Photo Station and QTS specific versions

[Impact] Unauthenticated remote attackers can access/modify system files and execute arbitrary commands, leading to full system compromise

[Mitigation] Immediately update Photo Station and QTS firmware to the latest recommended security patch versions

[Affected Scope] QNAP QTS operating system and Photo Station application

[Impact] Unauthenticated remote attackers can inject arbitrary system commands via crafted HTTP requests, leading to complete system compromise

[Mitigation] Immediately update QTS and Photo Station to the latest patched versions recommended by QNAP

[Affected Scope] QNAP Photo Station versions running on QTS operating system environments

[Impact] Unauthenticated remote attackers can bypass access control mechanisms to gain unauthorized system access, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately update QNAP Photo Station and QTS to the latest official security-patched versions