DIVD-2024-00016 - Command injection vulnerabilities in QNAP devices

Summary

Several (OS) command injection vulnerabilities have been found in QNAP devices. When exploited it’s possible for attackers with netowrk access to the device to execute commands. QNAP has linked CWE-78 to all mentioned CVE’s. This is related to ‘Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”)’.

Recommendations

QNAP recommends to upgrade to the latest version, to benefit from vulnerability fixes. On the versions below, the mentioned vulnerabilities have been fixed:

• QTS 5.x - QTS 5.1.3.2578 build 20231110 and later
• QTS 4.5.x - QTS 4.5.4.2627 build 20231225 and later
• QuTS hero h5.x - QuTS hero h5.1.3.2578 build 20231110 and later
• QuTS hero h4.5.x - QuTS hero h4.5.4.2626 build 20231225 and later
• QuTScloud c5.x - QuTScloud c5.1.5.2651 and later

DIVD recommends that you do not have this device reachable from the internet unless it is absolutely nessecary. If this is the case, a firewall rule should be placed in front of the QNAP device so that it can only be accessed from trusted IP addresses.

Please check also this QNAP page about their security advice tilted take immediate-actions to stop your nas from exposing to the internet.

–> Specially have a look at “Step 2: Disable the UPnP function of the QNAP NAS”

What we are doing

DIVD is currently working to identify vulnerable parties and notifying these. We do this by finding QNAP devices connected to the internet and verifying their version and build number. The notifications will be sent to the party responsible for the ip address according to the whois database.

Timeline

More information

• CVE-2024-27124
• CVE-2024-32766
• QNAP Security Advisory 24-09