PT-2021-11100 · Qnap · Surveillance Station

Published 2021-02-17 · Updated 2021-02-22 · CVE-2020-2501

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Surveillance Station versions prior to 5.1.5.4.3 for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station versions prior to 5.1.5.3.3 for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)

Description: A stack-based buffer overflow issue has been reported to affect QNAP NAS devices running Surveillance Station, allowing attackers to execute arbitrary code if exploited.

Recommendations: For Surveillance Station versions prior to 5.1.5.4.3 on ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS), update to version 5.1.5.4.3 or later. For Surveillance Station versions prior to 5.1.5.3.3 on ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS), update to version 5.1.5.3.3 or later.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2020-2501

Affected Products

Surveillance Station

References · 5

• https://osv.dev/vulnerability/CVE-2020-2501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2501 · Security Note
• https://qnap.com/en/security-advisory/qsa-21-07 · Vendor Advisory
• https://t.me/cibsecurity/23700 · Telegram Post
• https://t.me/cvenotify/10034 · Telegram Post