Command Injection Vulnerability in QTS and QuTS hero
Vulnerability Description
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later)
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-2508
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- CFF of Topsec Alpha Team
Affected Vendor
QNAP Systems Inc.
View all reports →