PT-2020-5350 · Qnap · Qes

Published 2020-12-23 · Updated 2020-12-28 · CVE-2020-2504

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions QNAP QES versions prior to 2.1.1 Build 20201006

Description This issue is related to an absolute path traversal vulnerability that could allow attackers to traverse files in File Station. The vulnerability is also associated with inadequate access control in the QES operating system, which could enable a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 2.1.1 Build 20201006, update to QES 2.1.1 Build 20201006 or later to resolve the issue. As a temporary workaround, consider restricting access to the File Station to minimize the risk of exploitation.

Fix

Improper Access Control

Path traversal

RCE

Weakness Enumeration

CWE-73

CWE-284

CWE-22

CWE-20

Related Identifiers

BDU:2021-00191

CVE-2020-2504

Affected Products

Qes

References · 9

• https://bdu.fstec.ru/vul/2021-00191 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2504 · Vendor Advisory
• https://qnap.com/zh-tw/security-advisory/qsa-20-17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2504 · Security Note
• https://securitylab.ru/news/515084.php · Note
• https://t.me/cvenotify/7686 · Telegram Post
• https://t.me/cvenotify/7819 · Telegram Post
• https://t.me/cvenotify/7685 · Telegram Post
• https://t.me/cibsecurity/21262 · Telegram Post