• QNAP has addressed critical vulnerabilities in its NAS and QuRouter systems.
• Users are urged to update their devices immediately to protect against potential exploitats.

Recent security advisories have identified critical vulnerabilities in QNAP’s Network Attached Storage (NAS) and QuRouter systems, allowing attackers to execute arbitrary commands on compromised devices. These flaws have prompted the company to remind users to update their systems.

QNAP, a well-known provider of network and software solutions with customers such as Accenture, Cognizant, and Infosys, has identified several severe issues in its NAS and router products. The vulnerabilities, which include missing authentication and OS command injection flaws, pose serious risks to users.

In a statement published over the weekend, QNAP acknowledged the issue, saying, “Multiple vulnerabilities have been reported to affect Notes Station 3 and QuRouter.” The company underlined the importance of using the latest updates to minimise risks.

The importance of securing NAS and routers

NAS systems and routers play a crucial role in both personal and professional settings. The devices are essential for centralised data storage, file sharing, and network traffic management. Given their role in storing sensitive data and maintaining connectivity, they are prime targets for cyberattacks.

NAS devices frequently house critical information, such as patient records, business files, and academic research. Routers, like those in QNAP’s QuRouter series, are responsible for ensuring secure and efficient data transmission. Exploiting vulnerabilities in such systems can allow attackers to gain unauthorised access, disrupt operations, or compromise networks.

The growing reliance on remote work and cloud computing has made securing these devices critical. Vulnerabilities like those found in QNAP’s products highlight the need for users to implement timely updates and adopt proactive security measures.

Among the identified issues, a vulnerability tracked as CVE-2024-38643 affects QNAP’s Notes Station 3. The missing authentication flaw could allow remote attackers to access systems without authorisation. The issue has been assigned a critical CVSS severity rating of 9.8/10. It affects Notes Station 3 versions 3.9.x, although QNAP addressed the problem in version 3.9.7 and later.

Another flaw, CVE-2024-38645, is a server-side request forgery (SSRF) vulnerability. After gaining access via the first flaw, attackers can read sensitive application data. This issue has a CVSS rating of 9.4/10.

CVE-2024-38644 is a command-injection vulnerability that enables attackers to execute arbitrary commands on affected systems. While rated slightly lower at 8.8/10, when combined with the other two vulnerabilities, it considerably raises the chance of a full system takeover.

QNAP has also disclosed flaws in its QuRouter networking devices, designed to manage routers for home and business users. The critical vulnerability, CVE-2024-48860, allows remote attackers to execute commands on the host system. This vulnerability has received a CVSS severity rating of 9.8/10.

The problem affects QuRouter versions 2.4.x but was resolved in version 2.4.3.106 of the device’s software. Another vulnerability, CVE-2024-48861, allows local attackers to execute commands on affected systems and carries a CVSS rating of 7.8.

Addressing the security risks

QNAP’s response to the vulnerabilities has been swift, with patches released to address the issues. However, users must act promptly by updating their devices to the latest software. The updates are critical to safeguarding data and maintaining the integrity of networks.

The vulnerabilities in QNAP’s NAS and router systems serve as a stark reminder of the importance of cybersecurity in a connected world. By staying vigilant and applying updates as soon as they become available, users can reduce risk and protect their systems from potential threats.

Want to learn more about cybersecurity and the cloud from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Digital Transformation Week, IoT Tech Expo, Blockchain Expo, and AI & Big Data Expo.

Explore other upcoming enterprise technology events and webinars powered by TechForge here.