Known exploited vulnerabilities
QNAP vulnerabilities attackers have used
Every QNAP vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 11 QNAP vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 9 used in ransomware campaigns. The most recent is CVE-2023-47565, added Dec 21, 2023. Network Attached Storage (NAS) has the most entries (4).
- In KEV, all time
- 11
- Added, last 12 months
- 0
- Used in ransomware
- 9
- New CVEs this week
- 0
By product
Network Attached Storage (NAS) (4), Photo Station (4), QNAP Network-Attached Storage (NAS) (1), QTS (1), VioStor NVR (1).
Every QNAP entry in CISA KEV
CVE-2023-47565
Added · dueQNAP VioStor NVR OS Command Injection Vulnerability
QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
QNAP Photo Station Externally Controlled Reference Vulnerability
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a…
QNAP Photo Station Path Traversal Vulnerability
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
QNAP Photo Station Path Traversal Vulnerability
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
QNAP QTS Improper Input Validation Vulnerability
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
QNAP Photo Station Improper Access Control Vulnerability
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
QNAP NAS File Station Command Injection Vulnerability
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
CVE-2020-2509
Added · dueQNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
QNAP NAS Improper Authorization Vulnerability
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.