Zero-day vulnerability in QNAP QTS

Improper access control

QNAP reported a security issue involving unauthorized access to the QNAP devices. Several QNAP NAS devices running QTS have been injected with XMR mining programs, specifically from

Vulnerability details

Advisory: SB2017050501 - Remote code execution in QNAP QTS

Vulnerable component: QNAP QTS


CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:U/RC:C

CWE-ID: CWE-284 - Improper Access Control


The vulnerability allows a remote attacker to compromise vulnerable device.

The vulnerability exists due to unknown error, which leads to QNAP device compromise. Vulnerability details are not disclosed yet.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable device.

Note: the vulnerability is being actively exploited in the wild.