by Kastro CVE-2020-2509
QNAP Systems Inc. QTS — Command Injection Vulnerability in QTS and QuTS hero
Description · from the CVE record
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
Affected
ProductAffectedFixed inSource
QTSunspecified – < 4.5.2.1566 Build 202102024.5.2.1566 Build 20210202CNA
QTSunspecified – < 4.5.1.1495 Build 202011234.5.1.1495 Build 20201123CNA
QTSunspecified – < 4.3.6.1620 Build 202103224.3.6.1620 Build 20210322CNA
QTSunspecified – < 4.3.4.1632 Build 202103244.3.4.1632 Build 20210324CNA
QTSunspecified – < 4.3.3.1624 Build 202104164.3.3.1624 Build 20210416CNA
QTSunspecified – < 4.2.6 Build 202103274.2.6 Build 20210327CNA
QuTS herounspecified – < h4.5.1.1491 build 20201119h4.5.1.1491 build 20201119CNA
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total