Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 33.4%; technical severity is CVSS 9.8.
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
Who should care
- Teams operating QNAP Network-Attached Storage (NAS), QTS, Quts Hero
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether QNAP Network-Attached Storage (NAS), QTS, Quts Hero is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Vendor advisory from www.qnap.com
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-77
- Affected versions
- QNAP QNAP Network-Attached Storage (NAS); QNAP QTS (End Excluding 4.2.6 | Start Including 4.3.5, End Excluding 4.3.6 | Start Including 4.4.0, End Excluding 4.5.1 | Version 4.2.6); QNAP Quts Hero (End Excluding h4.5.1 | Version h4.5.1 | Version h4.5.1.1472)
- Fixed versions
- QNAP QTS (Fixed from 4.2.6, 4.3.6, 4.5.1); QNAP Quts Hero (Fixed from h4.5.1)
- Published
- 17 April 2021
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 33.4%
- Signal calculated at 76