Zero-day vulnerability in QNAP QTS

Improper access control

QNAP reported a security issue involving unauthorized access to the QNAP devices. Several QNAP NAS devices running QTS have been injected with XMR mining programs, specifically from mineXMR.com.

Vulnerability details

Advisory: SB2017050501 - Remote code execution in QNAP QTS

Vulnerable component: QNAP QTS

CVE-ID:

CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:U/RC:C

CWE-ID: CWE-284 - Improper Access Control

Description:

The vulnerability allows a remote attacker to compromise vulnerable device.

The vulnerability exists due to unknown error, which leads to QNAP device compromise. Vulnerability details are not disclosed yet.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable device.

Note: the vulnerability is being actively exploited in the wild.

Vulnerability Scanning SaaS

Vulnerability scanning SaaS service is online 3-rd generation vulnerability scanner with scheduled assessments and vulnerability subscription. You can use service to check security of your network perimeter.