Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-2509: QNAP NAS allows attackers to run code remotely
CVE-2020-2509 · published 5 years ago · actively exploited
Summary
QNAP network-attached storage devices and their QTS/QUTS Hero software can be tricked into executing commands from an attacker. This could let a remote user take control of the device and access or modify data. Update the firmware to the latest version and apply any security patches provided by QNAP as soon as possible.
What to do
- Update qnap quts_hero to version h4.5.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| qnap | qnap network-attached storage (nas) | All versions |
| qnap | qts |
< 4.2.6 >= 4.3.5, < 4.3.6 >= 4.4.0, < 4.5.1 4.2.6 4.3.3.0174 4.3.3.0868 4.3.3.0998 4.3.3.1051 4.3.3.1098 4.3.3.1161 4.3.3.1252 4.3.3.1315 57 more version ranges
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* |
| qnap | quts_hero |
< h4.5.1 h4.5.1 h4.5.1.1472 cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* |
Original advisory text
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
References
- https://www.qnap.com/en/security-advisory/qsa-21-05 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
34%
chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published17 Apr 2021
Updated22 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta