Vulnerability identifier: #VU48238

Vulnerability risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
QNAP QTS
Server applications / File servers (FTP/HTTP)

Vendor: QNAP Systems, Inc.

Description

The vulnerabilities allow a remote attacker to bypass implemented security restrictions.

Multiple unspecified vulnerabilities have been identified and fixed in Surveillance Station, QVPN Service, Qfiling, Qsync Central, QcalAgent, and IFTTT Agent applications.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

QNAP QTS: 4.5.1.1456 20201015 - 4.5.1.1465 20201024

---

External links
http://www.qnap.com/en/release-notes/qts/4.5.1.1480/20201108

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.