QNAP fixes host of security updates following major issues

News
By
published

Almost two dozen flaws fixed across various QNAP products

An image of network security icons for a network encircling a digital blue earth.
(Image credit: Shutterstock) (Image credit: Shutterstock)
  • QNAP addresses 17 vulnerabilities with a variety of patches
  • Among the affected products are Notes Station 3, QuRouter, and others
  • Some of the bugs are deemed critical and highly dangerous

QNAP has released fixes for a number of security vulnerabilities, including several flaws deemed “critical”.

In total, QNAP addressed 17 different vulnerabilities, and the full detailed list can be found on this link. Since many of the flaws are critical and can be used to take over endpoints, steal sensitive data, and deploy malware, users are advised to apply the patches as soon as possible.

In its security advisory, QNAP said the vulnerabilities affected Notes Station 3, QuRouter, AI Core, QuLog Center, QTS, and QuTS Hero.

Patches and fixes

The most severe of the bugs is an OS command injection flaw that allows threat actors to run arbitrary commands on the target system. It impacts QNAP’s high-speed, secure routers QuRouter 2.4.x. It is tracked as CVE-2024-48860 and has a severity score of 9.5 (critical).

The second-highest, critical vulnerability, is tracked as CVE-2024-38645, and has a score of 9.4. It was found in QNAP’s note-taking and collaboration application Notes Station 3, and is tracked as CVE-2024-38645. This one is described as a server-side request forgery (SSRF) bug that enables threat actors with authentication credentials to send custom-built requests and ultimately expose sensitive app data.

Another Notes Station 3 flaw made the top three, CVE-2024-38643, with a severity score of 9.3. This missing authentication for critical functions bug allows crooks to gain unauthorized access and run different system functions, which can lead to credential theft and system compromise.

QNAP devices are extremely popular targets for cybercriminals, and as such should be handled with care. Security experts advise these advices never be connected directly to the internet, but rather be protected behind a VPN.

Via BleepingComputer

You might also like

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.