QNAP fixes critical security holes in its networking solutions

Home / Security, Vulnerabilities / QNAP fixes critical security holes in its networking solutions

QNAP fixes critical security holes in its networking solutions

November 26, 2024 cyberelias 0 Comments 1 tag

Critical NAS read and code execution vulnerabilities

Tracked as CVE-2024-38643, a missing authentication for critical function vulnerability in QNAP’s note-taking and collaboration application for its NAS devices, Notes Station 3, could provide a remote attacker unauthorized access into the vulnerable systems.

The vulnerability, which has received a CVSS v3 severity rating of 9.8 out of 10, affects Notes Station 3 versions 3.9.x, and has been fixed in versions 3.9.7 and later. Other than the IT service providers, QNAP’s NAS services are used by a number of organizations in the media and entertainment, healthcare, and education segments for their trusted data storage hardware.

Affecting the same versions of the application is another server-side request forgery (SSRF) flaw, tracked as CVE-2024-38645, allowing remote actors with compromised access through CVE-2024-38643 to read full application data. The flaw carries a CVSS v4 rating of 9.4/10.

Tags: Security, Vulnerabilities

Explore More

Infostealers are using BYOVD to steal critical system data

While the payload included the promised functionality, which itself accounts for piracy, it also delivered “sophisticated” malware directly onto users’ computers. Because Foxit’s installation directory resides in the “Program Files”

The bug, with a severity rating of CVSS 9.8 out of 10, can be used to read any files, including passwords and other secrets. “The typical attack strategy is to

CISOs who delayed patching Palo Alto vulnerabilities now face real threat

“Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet,” Palo Alto