- QNAP addresses 17 vulnerabilities with a variety of patches
- Among the affected products are Notes Station 3, QuRouter, and others
- Some of the bugs are deemed critical and highly dangerous
QNAP has released fixes for a number of security vulnerabilities, including several flaws deemed “critical”.
In total, QNAP addressed 17 different vulnerabilities, and the full detailed list can be found on this link. Since many of the flaws are critical and can be used to take over endpoints, steal sensitive data, and deploy malware, users are advised to apply the patches as soon as possible.
In its security advisory, QNAP said the vulnerabilities affected Notes Station 3, QuRouter, AI Core, QuLog Center, QTS, and QuTS Hero.
Patches and fixes
The most severe of the bugs is an OS command injection flaw that allows threat actors to run arbitrary commands on the target system. It impacts QNAP’s high-speed, secure routers QuRouter 2.4.x. It is tracked as CVE-2024-48860 and has a severity score of 9.5 (critical).
The second-highest, critical vulnerability, is tracked as CVE-2024-38645, and has a score of 9.4. It was found in QNAP’s note-taking and collaboration application Notes Station 3, and is tracked as CVE-2024-38645. This one is described as a server-side request forgery (SSRF) bug that enables threat actors with authentication credentials to send custom-built requests and ultimately expose sensitive app data.
Another Notes Station 3 flaw made the top three, CVE-2024-38643, with a severity score of 9.3. This missing authentication for critical functions bug allows crooks to gain unauthorized access and run different system functions, which can lead to credential theft and system compromise.
QNAP devices are extremely popular targets for cybercriminals, and as such should be handled with care. Security experts advise these advices never be connected directly to the internet, but rather be protected behind a VPN.
Via BleepingComputer