This vulnerability allows remote malicious users to make arbitrary changes to configuration on affected installations of QNAP TS-464 NAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privWizard API endpoints. The issue results from the lack of proper validation of a user-supplied string before using it to update configuration. An attacker can leverage this vulnerability to change the configuration of the system.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
qnap qts 5.1.3.2578 |
||
qnap quts hero h5.1.3.2578 |
||
qnap qts 4.5.4.2627 |
||
qnap quts hero h4.5.4.2626 |
||
qnap qts |
||
qnap qutscloud |
||
qnap quts hero |
QNAP warns of critical auth bypass flaw in its NAS devices By Bill Toulas March 8, 2024 03:03 PM 0 QNAP warns of vulnerabilities in its NAS software products, including QTS, QuTS hero, QuTScloud, and myQNAPcloud, that could allow attackers to access devices. The Taiwanese Network Attached Storage (NAS) device maker disclosed three vulnerabilities that can lead to an authentication bypass, command injection, and SQL injection. While the last two require the attackers to be authenticated...
Vulmon