Vendor
QNAP: actively exploited vulnerabilities
12 vulnerabilities in QNAP products are listed in CISA’s catalog of actively exploited vulnerabilities, 9 of them used by ransomware. Latest addition on December 21, 2023: CVE-2023-47565 (VioStor NVR).
- 12 exploited vulnerabilities in the catalog
- 0 added in the last 12 months
- 9 used by ransomware
- 6 products affected
Affected products
- Network Attached Storage (NAS)4
- Photo Station4
- Helpdesk1
- QNAP Network-Attached Storage (NAS)1
- QTS1
- VioStor NVR1
All exploited vulnerabilities
CISA KEV catalog, newest first: each entry corresponds to observed exploitation.
2023 1 vulnerability
-
CVE-2023-47565QNAP VioStor NVR OS Command Injection Vulnerability
2022 11 vulnerabilities
-
CVE-2022-27593Used by ransomwareQNAP Photo Station Externally Controlled Reference Vulnerability
-
CVE-2019-7195Used by ransomwareQNAP Photo Station Path Traversal Vulnerability
-
CVE-2019-7194Used by ransomwareQNAP Photo Station Path Traversal Vulnerability
-
CVE-2019-7193Used by ransomwareQNAP QTS Improper Input Validation Vulnerability
-
CVE-2019-7192Used by ransomwareQNAP Photo Station Improper Access Control Vulnerability
-
CVE-2018-19953Used by ransomwareQNAP NAS File Station Cross-Site Scripting Vulnerability
-
CVE-2018-19949Used by ransomwareQNAP NAS File Station Command Injection Vulnerability
-
CVE-2018-19943Used by ransomwareQNAP NAS File Station Cross-Site Scripting Vulnerability
-
CVE-2020-2509QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
-
CVE-2021-28799Used by ransomwareQNAP NAS Improper Authorization Vulnerability
-
CVE-2020-2506QNAP Helpdesk Improper Access Control Vulnerability
What to do
If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.
Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.