CVE-2021-44054: Open redirect

Q: What is CVE-2021-44054?

CVE-2021-44054 is an open redirect vulnerability affecting QNAP devices running QuTScloud, QuTS hero, and QTS.

Q: How does CVE-2021-44054 impact users?

CVE-2021-44054 allows attackers to redirect users to untrusted pages that may contain malware.

Q: Which software versions are affected by CVE-2021-44054?

CVE-2021-44054 affects various versions of QNAP QTS, QNAP QTS hero, and QNAP QTScloud.

Q: How severe is CVE-2021-44054?

CVE-2021-44054 has a medium severity rating with a CVSS score of 6.1.

Q: How can I fix CVE-2021-44054?

To fix CVE-2021-44054, update your QNAP device to the fixed versions mentioned in the QNAP Security Advisory QSA-22-16.

Published May 5, 2022

Updated

An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Affected Software

34 affected components

QNAP QTS>=5.0.0.1716<5.0.0.1986

QNAP QTS>=4.3.3.0174<4.3.3.1945

QNAP QTS>=4.3.4.0899<4.3.4.1976

QNAP QTS>=4.3.6.0895<4.3.6.1965

QNAP QTS>=4.4.0.0883<4.5.4.1991

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP QTS=4.2.6-build_20200109

QNAP QTS=4.2.6-build_20200421

QNAP QTS=4.2.6-build_20200611

QNAP QTS=4.2.6-build_20200821

QNAP QTS=4.2.6-build_20210327

QNAP QTS=4.2.6-build_20211215

QNAP QuTS hero<h4.5.4.1771

QNAP QuTS hero>=h5.0.0.1772<h5.0.0.1986

QNAP QuTScloud<c5.0.1.1998

QNAP QTS>=4.3.3.0174<4.3.3.1945

QNAP QTS>=4.3.4.0899<4.3.4.1976

QNAP QTS>=4.3.6.0895<4.3.6.1965

QNAP QTS>=4.4.0.0883<4.5.4.1991

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP QTS=4.2.6-build_20200109

QNAP QTS=4.2.6-build_20200421

QNAP QTS=4.2.6-build_20200611

QNAP QTS=4.2.6-build_20200821

QNAP QTS=4.2.6-build_20210327

QNAP QTS=4.2.6-build_20211215

Remediation

Information

We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Event History

May 5, 2022

CVE Published

via MITRE·04:50 PM

Data Sourced

via MITRE·04:50 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-44054?

CVE-2021-44054 is an open redirect vulnerability affecting QNAP devices running QuTScloud, QuTS hero, and QTS.

How does CVE-2021-44054 impact users?