CVE-2020-2509: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

Published Apr 17, 2021
·
Updated

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

Other sources

QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.

— CISA

Affected Software

97 affected components
QNAP QTS=4.3.3.0174
QNAP QTS=4.3.3.0868
QNAP QTS=4.3.3.0998
QNAP QTS=4.3.3.1051
QNAP QTS=4.3.3.1098
QNAP QTS=4.3.3.1161
QNAP QTS=4.3.3.1252
QNAP QTS=4.3.3.1315
QNAP QTS=4.3.3.1386
QNAP QTS=4.3.3.1432
QNAP QTS<4.2.6
QNAP QTS>=4.3.5<4.3.6
QNAP QTS>=4.4.0<4.5.1
QNAP QTS=4.2.6
QNAP QTS=4.2.6-build_20170517
QNAP QTS=4.2.6-build_20190322
QNAP QTS=4.2.6-build_20190730
QNAP QTS=4.2.6-build_20190921
QNAP QTS=4.2.6-build_20191107
QNAP QTS=4.2.6-build_20200109
QNAP QTS=4.2.6-build_20200421
QNAP QTS=4.2.6-build_20200611
QNAP QTS=4.2.6-build_20200821
QNAP QTS=4.3.4.0358
QNAP QTS=4.3.4.0358-beta1
QNAP QTS=4.3.4.0370
QNAP QTS=4.3.4.0370-beta1
QNAP QTS=4.3.4.0372
QNAP QTS=4.3.4.0372-beta1
QNAP QTS=4.3.4.0374
QNAP QTS=4.3.4.0374-beta1
QNAP QTS=4.3.4.0387
QNAP QTS=4.3.4.0387-beta2
QNAP QTS=4.3.4.0411
QNAP QTS=4.3.4.0416
QNAP QTS=4.3.4.0427
QNAP QTS=4.3.4.0434
QNAP QTS=4.3.4.0435
QNAP QTS=4.3.4.0451
QNAP QTS=4.3.4.0483
QNAP QTS=4.3.4.0486
QNAP QTS=4.3.4.0506
QNAP QTS=4.3.4.0516
QNAP QTS=4.3.4.0526
QNAP QTS=4.3.4.0551
QNAP QTS=4.3.4.0557
QNAP QTS=4.3.4.0561
QNAP QTS=4.3.4.0569
QNAP QTS=4.3.4.0593
QNAP QTS=4.3.4.0597
QNAP QTS=4.3.4.0604
QNAP QTS=4.3.4.0899
QNAP QTS=4.3.4.1029
QNAP QTS=4.3.4.1082
QNAP QTS=4.3.4.1190
QNAP QTS=4.3.4.1282
QNAP QTS=4.3.4.1368
QNAP QTS=4.3.4.1417
QNAP QTS=4.3.4.1463
QNAP QTS=4.3.6
QNAP QTS=4.3.6.0895
QNAP QTS=4.3.6.0907
QNAP QTS=4.3.6.0923
QNAP QTS=4.3.6.0944
QNAP QTS=4.3.6.0959
QNAP QTS=4.3.6.0979
QNAP QTS=4.3.6.0993
QNAP QTS=4.3.6.1013
QNAP QTS=4.3.6.1033
QNAP QTS=4.3.6.1070
QNAP QTS=4.3.6.1154
QNAP QTS=4.3.6.1218
QNAP QTS=4.3.6.1263
QNAP QTS=4.3.6.1286
QNAP QTS=4.3.6.1333
QNAP QTS=4.3.6.1411
QNAP QTS=4.3.6.1446
QNAP QTS=4.5.1
QNAP QTS=4.5.1.1456
QNAP QTS=4.5.1.1461
QNAP QTS=4.5.1.1465
QNAP QTS=4.5.1.1480
QNAP QTS=4.5.2
QNAP QuTS hero<h4.5.1
QNAP QuTS hero=h4.5.1
QNAP QuTS hero=h4.5.1.1472
QNAP QTS=4.3.3.0174
QNAP QTS=4.3.3.0868
QNAP QTS=4.3.3.0998
QNAP QTS=4.3.3.1051
QNAP QTS=4.3.3.1098
QNAP QTS=4.3.3.1161
QNAP QTS=4.3.3.1252
QNAP QTS=4.3.3.1315
QNAP QTS=4.3.3.1386
QNAP QTS=4.3.3.1432
QNAP QNAP Network-Attached Storage (NAS)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade QNAP QTS to a version that resolves this vulnerability.

    Fixed in 4.2.6 Build 20210327
  2. Upgrade

    Upgrade QNAP QTS to a version that resolves this vulnerability.

    Fixed in 4.3.3.1624 Build 20210416
  3. Upgrade

    Upgrade QNAP QTS to a version that resolves this vulnerability.

    Fixed in 4.3.4.1632 Build 20210324
  4. Upgrade

    Upgrade QNAP QTS to a version that resolves this vulnerability.

    Fixed in 4.3.6.1620 Build 20210322
  5. Upgrade

    Upgrade QNAP QTS to a version that resolves this vulnerability.

    Fixed in 4.5.1.1495 Build 20201123
  6. Upgrade

    Upgrade QNAP QTS to a version that resolves this vulnerability.

    Fixed in 4.5.2.1566 Build 20210202
  7. Upgrade

    Upgrade QNAP QuTS hero to a version that resolves this vulnerability.

    Fixed in h4.5.1.1491 build 20201119

Event History

Apr 17, 2021
CVE Published
via MITRE·03:50 AM
Data Sourced
via MITRE·03:50 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·04:15 AM
DescriptionSeverityWeaknessAffected Software
Apr 11, 2022
Known Exploited
via CISA·12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-2509?

CVE-2020-2509 is considered a high severity command injection vulnerability that can allow attackers to execute arbitrary commands.

2

What versions are affected by CVE-2020-2509?

CVE-2020-2509 affects multiple versions of QNAP QTS, specifically versions prior to 4.5.2.1566.

3

How do I fix CVE-2020-2509?

To mitigate CVE-2020-2509, update your QNAP QTS to version 4.5.2.1566 or higher.

4

What software does CVE-2020-2509 affect?

CVE-2020-2509 primarily affects QNAP's QTS and QuTS hero systems.

5

Can CVE-2020-2509 be exploited remotely?

Yes, an attacker can exploit CVE-2020-2509 remotely if they have access to the affected QNAP device.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203