Huasheng_Mangguo

**Nome do software vulnerável e versões afetadas** Versões do QTS anteriores à 4.5.4.2790 build 20240605 Versões do QuTS hero anteriores à h4.5.4.2626 build 20231225 **Descrição** Foi relatada uma vulnerabilidade de injeção de comando do sistema operacional que afeta várias versões do sistema operacional QNAP. Se explorada, a vulnerabilidade poderia permitir que usuários executassem comandos através de uma rede. O problema está relacionado à falha em neutralizar elementos especiais usados no comando do sistema operacional. **Recomendações** Para versões do QTS anteriores à 4.5.4.2790 build 20240605, atualize para a versão 4.5.4.2790 build 20240605 ou posterior. Para versões do QuTS hero anteriores à h4.5.4.2626 build 20231225, atualize para a versão h4.5.4.2626 build 20231225 ou posterior.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 5.1.0.2444 build 20230629 QuTS hero versions prior to h5.1.0.2424 build 20230609 QuTScloud versions prior to c5.1.0.2498 **Description** A path traversal vulnerability has been reported, which could allow users to read the contents of unexpected files and expose sensitive data via a network. The issue is related to incorrect restriction of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to disclose protected information. **Recommendations** For QTS versions prior to 5.1.0.2444 build 20230629, update to QTS 5.1.0.2444 build 20230629 or later. For QuTS hero versions prior to h5.1.0.2424 build 20230609, update to QuTS hero h5.1.0.2424 build 20230609 or later. For QuTScloud versions prior to c5.1.0.2498, update to QuTScloud c5.1.0.2498 or later.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 5.0.1.2277 QTS versions prior to 4.5.4.2280 build 20230112 QuTS hero versions prior to h5.0.1.2277 build 20230112 QuTS hero versions prior to h4.5.4.2374 build 20230417 QuTScloud versions prior to c5.0.1.2374 **Description** An uncontrolled resource consumption issue affects several QNAP operating system versions. If exploited, this could allow remote attackers to launch a denial-of-service (DoS) attack. **Recommendations** For QTS versions prior to 5.0.1.2277, update to version 5.0.1.2277 or later. For QTS versions prior to 4.5.4.2280 build 20230112, update to version 4.5.4.2280 build 20230112 or later. For QuTS hero versions prior to h5.0.1.2277 build 20230112, update to version h5.0.1.2277 build 20230112 or later. For QuTS hero versions prior to h4.5.4.2374 build 20230417, update to version h4.5.4.2374 build 20230417 or later. For QuTScloud versions prior to c5.0.1.2374, update to version c5.0.1.2374 or later.

**Name of the Vulnerable Software and Affected Versions** QuTS hero versions prior to h5.0.1.2248 build 20221215 QTS versions prior to 5.0.1.2234 build 20221201 **Description** A vulnerability has been reported to affect QNAP devices running QuTS hero and QTS, allowing remote attackers to inject malicious code. This issue is related to a SQL injection vulnerability. The vulnerability poses a threat to the confidentiality and integrity of the stored data. NAS devices are often targeted by ransomware due to the valuable data they store and their exposure to the Internet. **Recommendations** For QuTS hero versions prior to h5.0.1.2248 build 20221215, update to version h5.0.1.2248 build 20221215 or later. For QTS versions prior to 5.0.1.2234 build 20221201, update to version 5.0.1.2234 build 20221201 or later.