CVE-2020-2509 QNAP Network-Attached Storage (NAS) Command Injection
Attackers can execute arbitrary commands on QNAP NAS devices running QTS or QuTS hero, requiring an upgrade to patched firmware versions.
- Exploited in the wild
- Since 11 Apr 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-2509?
CVE-2020-2509 is a critical command injection vulnerability in Qnap Qts, published on 17 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
Which versions are affected by CVE-2020-2509?
It affects 2 products.
Products include Qnap Qts, Qnap Quts Hero.
How do I fix CVE-2020-2509?
No fix has been published for CVE-2020-2509 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 2 May 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-2509 being exploited?
Yes. Attackers have exploited CVE-2020-2509 in the wild since at least 11 Apr 2022.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Qnap Qts
Sources
Also known as GHSA-77jf-5mcg-g6m9.