Skip to content
OpenAdvisories
High WID-SEC-2024-0589 6 CVEs

QNAP NAS: Mehrere Schwachstellen

Published Mar 10, 2024 · Updated Mar 10, 2024 · de-DE

Vendor: QNAP Systems Product: NAS

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in QNAP NAS ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, beliebigen Code auszuführen, Dateien zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.

Product

QNAP ist ein Hersteller von NAS (Network Attached Storage) Lösungen.

Vulnerabilities 6

  • Critical 9.8
    CVE-2024-21899 EPSS 24%

    QTS, QuTS hero, QuTScloud

    An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in t…

    QNAP Systems QTS QuTS hero QuTScloud
  • Medium 6.6
    CVE-2023-34975

    QTS, QuTS hero, QuTScloud

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. QuTScloud is not affected. We have already fi…

    QNAP Systems QTS QuTS hero QuTScloud
  • Medium 5.9
    CVE-2023-34980

    QTS, QuTS hero

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in th…

    QNAP Systems QTS QuTS hero
  • Medium 4.9
    CVE-2023-32969

    Network & Virtual Switch

    A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the fo…

    QNAP Systems QTS QuTS hero QuTScloud
  • Medium 4.7
    CVE-2024-21901 EPSS 19%

    myQNAPcloud

    A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcl…

    QNAP Systems QTS myQNAPcloud
  • Medium 4.3
    CVE-2024-21900

    QTS, QuTS hero, QuTScloud

    An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions…

    QNAP Systems QTS QuTS hero QuTScloud

Revision history

  1. #1

    Initiale Fassung

References