Critical NAS read and code execution vulnerabilities

Tracked as CVE-2024-38643, a missing authentication for critical function vulnerability in QNAP’s note-taking and collaboration application for its NAS devices, Notes Station 3, could provide a remote attacker unauthorized access into the vulnerable systems.

The vulnerability, which has received a CVSS v3 severity rating of 9.8 out of 10, affects Notes Station 3 versions 3.9.x, and has been fixed in versions 3.9.7 and later. Other than the IT service providers, QNAP’s NAS services are used by a number of organizations in the media and entertainment, healthcare, and education segments for their trusted data storage hardware.

Affecting the same versions of the application is another server-side request forgery (SSRF) flaw, tracked as CVE-2024-38645, allowing remote actors with compromised access through CVE-2024-38643 to read full application data. The flaw carries a CVSS v4 rating of 9.4/10.

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Microsoft fails to collect critical security logs, exposing customers to risks

Widespread impact on security monitoring Microsoft acknowledged that the logging failure affected a range of key services. Microsoft Sentinel, a widely used security tool, suffered gaps in its logs, making

Read More

Critical SolarWinds flaw finds exploitations in the wild despite available fixes

Incidentally, during a critical oversight, SolarWinds developers unintentionally left some hardcoded credentials within the web help desk (WHD), opening the vulnerable instances to easy malicious access without the deployment of

Read More

Security researchers circumvent Microsoft Azure AI Content Safety

Stress testing Mindgard deployed these two filters in front of ChatGPT 3.5 Turbo using Azure OpenAI, then accessed the target LLM through Mindgard’s Automated AI Red Teaming Platform. Two attack

Read More