Critical WID-SEC-2024-3311 1 CVE

QNAP NAS SMB Service: Schwachstelle ermöglicht Privilegieneskalation

Published Oct 30, 2024 · Updated Oct 30, 2024 · de-DE

Vendor: QNAP Systems Product: NAS

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QNAP NAS SMB Service ausnutzen, um seine Privilegien zu erhöhen.

Product

QNAP ist ein Hersteller von NAS (Network Attached Storage) Lösungen.

Vulnerabilities 1

Critical 10.0

CVE-2024-50387

SMB Service

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: SMB Serv…

QNAP Systems SMB Service

Dec 6, 2024

Revision history

2024-10-30 #1
Initiale Fassung

References

QNAP Security Advisory vom 2024-10-30
https://www.qnap.com/en/security-advisory/qsa-24-42
Proof of Concept (PoC)
https://securityonline.info/cve-2024-50387-critical-qnap-flaw-exploited-in-hacking-contest-patch-now/