DIVD-2024-00016 - Command injection vulnerabilities in QNAP devices

Summary

Several (OS) command injection has been found in QNAP devices, when exploited it’s possible for attackers to execute commands via a network. QNAP has linked CWE-78 to all mentioned CVE’s. This is related to ‘Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”)’.

Recommendations

QNAP recommends to upgrade to the latest version, to benefit from vulnerability fixes. On the versions below, the mentioned vulnerabilities have been fixed:

• QTS 5.x - QTS 5.1.3.2578 build 20231110 and later
• QTS 4.5.x - QTS 4.5.4.2627 build 20231225 and later
• QuTS hero h5.x - QuTS hero h5.1.3.2578 build 20231110 and later
• QuTS hero h4.5.x - QuTS hero h4.5.4.2626 build 20231225 and later
• QuTScloud c5.x - QuTScloud c5.1.5.2651 and later

DIVD recommends considering whether it is necessary to have the device listening to the Internet. Firewall rules could possibly be placed in front of the QNAP device so that it can only be accessed from trusted IP addresses.

Please check also this QNAP page about their security advice: take-immediate-actions-to-stop-your-nas-from-exposing-to-the-internet

–> Specially have a look at “Step 2: Disable the UPnP function of the QNAP NAS”

What we are doing

DIVD is currently working to identify vulnerable parties and notifying these. We do this by finding QNAP devices connected to the internet and verifying their version and build number. The notifications will be sent to the party responsible for the ip address according to the whois database.

Timeline

More information

• CVE-2024-27124
• CVE-2024-32766
• QNAP Security Advisory 24-09