QNAP reported a security issue involving unauthorized access to the QNAP devices. Several QNAP NAS devices running QTS have been injected with XMR mining programs, specifically from mineXMR.com.
Vulnerable component: QNAP QTS
CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:U/RC:C
CWE-ID: CWE-284 - Improper Access Control
The vulnerability allows a remote attacker to compromise vulnerable device.
The vulnerability exists due to unknown error, which leads to QNAP device compromise. Vulnerability details are not disclosed yet.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable device.
Note: the vulnerability is being actively exploited in the wild.
Vulnerability scanning SaaS service is online 3-rd generation vulnerability scanner with scheduled assessments and vulnerability subscription. You can use service to check security of your network perimeter.