by Kastro
Paper/Archive/CVE-2024-32764

CVE-2024-32764

QNAP Systems Inc. myQNAPcloud Link — myQNAPcloud Link

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
37
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 36.3.363 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability in the following version: myQNAPcloud Link 2.4.51 and later

Affected

ProductAffectedFixed inSource
myQNAPcloud Link2.4.x – < 2.4.512.4.51CNA
myqnapcloud_link2.4 – < 2.4.512.4.51CISA-ADP

Scores by source

qnap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refqnap.com/en/security-advisory/qsa-24-09