Exploited
critical
9.8
CWE
77 78
Advisory Published
Updated

CVE-2020-2509: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

First published: Sat Apr 17 2021(Updated: )

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

Credit: security@qnapsecurity.com.tw security@qnapsecurity.com.tw security@qnapsecurity.com.tw

Affected SoftwareAffected VersionHow to fix
QNAP QTS=4.3.3.0174
QNAP QTS=4.3.3.0868
QNAP QTS=4.3.3.0998
QNAP QTS=4.3.3.1051
QNAP QTS=4.3.3.1098
QNAP QTS=4.3.3.1161
QNAP QTS=4.3.3.1252
QNAP QTS=4.3.3.1315
QNAP QTS=4.3.3.1386
QNAP QTS=4.3.3.1432
QNAP QTS<4.2.6
QNAP QTS>=4.3.5<4.3.6
QNAP QTS>=4.4.0<4.5.1
QNAP QTS=4.2.6
QNAP QTS=4.2.6-build_20170517
QNAP QTS=4.2.6-build_20190322
QNAP QTS=4.2.6-build_20190730
QNAP QTS=4.2.6-build_20190921
QNAP QTS=4.2.6-build_20191107
QNAP QTS=4.2.6-build_20200109
QNAP QTS=4.2.6-build_20200421
QNAP QTS=4.2.6-build_20200611
QNAP QTS=4.2.6-build_20200821
QNAP QTS=4.3.4.0358
QNAP QTS=4.3.4.0358-beta1
QNAP QTS=4.3.4.0370
QNAP QTS=4.3.4.0370-beta1
QNAP QTS=4.3.4.0372
QNAP QTS=4.3.4.0372-beta1
QNAP QTS=4.3.4.0374
QNAP QTS=4.3.4.0374-beta1
QNAP QTS=4.3.4.0387
QNAP QTS=4.3.4.0387-beta2
QNAP QTS=4.3.4.0411
QNAP QTS=4.3.4.0416
QNAP QTS=4.3.4.0427
QNAP QTS=4.3.4.0434
QNAP QTS=4.3.4.0435
QNAP QTS=4.3.4.0451
QNAP QTS=4.3.4.0483
QNAP QTS=4.3.4.0486
QNAP QTS=4.3.4.0506
QNAP QTS=4.3.4.0516
QNAP QTS=4.3.4.0526
QNAP QTS=4.3.4.0551
QNAP QTS=4.3.4.0557
QNAP QTS=4.3.4.0561
QNAP QTS=4.3.4.0569
QNAP QTS=4.3.4.0593
QNAP QTS=4.3.4.0597
QNAP QTS=4.3.4.0604
QNAP QTS=4.3.4.0899
QNAP QTS=4.3.4.1029
QNAP QTS=4.3.4.1082
QNAP QTS=4.3.4.1190
QNAP QTS=4.3.4.1282
QNAP QTS=4.3.4.1368
QNAP QTS=4.3.4.1417
QNAP QTS=4.3.4.1463
QNAP QTS=4.3.6
QNAP QTS=4.3.6.0895
QNAP QTS=4.3.6.0907
QNAP QTS=4.3.6.0923
QNAP QTS=4.3.6.0944
QNAP QTS=4.3.6.0959
QNAP QTS=4.3.6.0979
QNAP QTS=4.3.6.0993
QNAP QTS=4.3.6.1013
QNAP QTS=4.3.6.1033
QNAP QTS=4.3.6.1070
QNAP QTS=4.3.6.1154
QNAP QTS=4.3.6.1218
QNAP QTS=4.3.6.1263
QNAP QTS=4.3.6.1286
QNAP QTS=4.3.6.1333
QNAP QTS=4.3.6.1411
QNAP QTS=4.3.6.1446
QNAP QTS=4.5.1
QNAP QTS=4.5.1.1456
QNAP QTS=4.5.1.1461
QNAP QTS=4.5.1.1465
QNAP QTS=4.5.1.1480
QNAP QTS=4.5.2
QNAP QuTS hero<h4.5.1
QNAP QuTS hero=h4.5.1
QNAP QuTS hero=h4.5.1.1472
QNAP QTS=4.3.3.0174
QNAP QTS=4.3.3.0868
QNAP QTS=4.3.3.0998
QNAP QTS=4.3.3.1051
QNAP QTS=4.3.3.1098
QNAP QTS=4.3.3.1161
QNAP QTS=4.3.3.1252
QNAP QTS=4.3.3.1315
QNAP QTS=4.3.3.1386
QNAP QTS=4.3.3.1432
QNAP NAS

Remedy

QNAP has already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2020-2509?

    CVE-2020-2509 is considered a high severity command injection vulnerability that can allow attackers to execute arbitrary commands.

  • What versions are affected by CVE-2020-2509?

    CVE-2020-2509 affects multiple versions of QNAP QTS, specifically versions prior to 4.5.2.1566.

  • How do I fix CVE-2020-2509?

    To mitigate CVE-2020-2509, update your QNAP QTS to version 4.5.2.1566 or higher.

  • What software does CVE-2020-2509 affect?

    CVE-2020-2509 primarily affects QNAP's QTS and QuTS hero systems.

  • Can CVE-2020-2509 be exploited remotely?

    Yes, an attacker can exploit CVE-2020-2509 remotely if they have access to the affected QNAP device.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203