PT-2021-7653 · Qnap · Quts Hero+1

Omri Mallis + 1 · Published 2021-04-03 · Updated 2025-02-13 · CVE-2020-2509

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.5.2.1566 Build 20210202 QTS versions prior to 4.5.1.1495 Build 20201123 QTS versions prior to 4.3.6.1620 Build 20210322 QTS versions prior to 4.3.4.1632 Build 20210324 QTS versions prior to 4.3.3.1624 Build 20210416 QTS versions prior to 4.2.6 Build 20210327 QuTS hero versions prior to h4.5.1.1491 build 20201119

Description A command injection vulnerability has been reported to affect QTS and QuTS hero, allowing attackers to execute arbitrary commands in a compromised application by sending a special HTTP request. This vulnerability is related to the lack of measures to neutralize special elements used in operating system commands.

Recommendations For QTS versions prior to 4.5.2.1566 Build 20210202, update to QTS 4.5.2.1566 Build 20210202 or later. For QTS versions prior to 4.5.1.1495 Build 20201123, update to QTS 4.5.1.1495 Build 20201123 or later. For QTS versions prior to 4.3.6.1620 Build 20210322, update to QTS 4.3.6.1620 Build 20210322 or later. For QTS versions prior to 4.3.4.1632 Build 20210324, update to QTS 4.3.4.1632 Build 20210324 or later. For QTS versions prior to 4.3.3.1624 Build 20210416, update to QTS 4.3.3.1624 Build 20210416 or later. For QTS versions prior to 4.2.6 Build 20210327, update to QTS 4.2.6 Build 20210327 or later. For QuTS hero versions prior to h4.5.1.1491 build 20201119, update to QuTS hero h4.5.1.1491 build 20201119 or later.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2023-00927

CVE-2020-2509

Affected Products

Qts

Quts Hero

References · 10

• 🔥 https://github.com/jbaines-r7/overkill · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-2509 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2509 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-21-05 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00927 · Security Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/13409 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2509 · Note
• https://t.me/ckure/7438 · Telegram Post
• https://t.me/cvenotify/111200 · Telegram Post