QNAP warns of critical auth bypass flaw in its NAS devices

QNAP warns of vulnerabilities in its NAS software products, including QTS, QuTS hero, QuTScloud, and myQNAPcloud, that could allow attackers to access devices. The Taiwanese Network Attached Storage (NAS) device maker disclosed three vulnerabilities that can lead to an authentication bypass, command injection, and SQL injection. While the last two require the attackers to be authenticated on the target system, which significantly lessens the risk, the first (CVE-2024-21899) can be executed remotely without authentication and is marked as "low complexity." The three flaws fixed are the following: The flaws impact various versions of QNAP's operating systems, including QTS 5.1.x, QTS 4.5.x, QuTS hero h5.1.x, QuTS hero h4.5.x, QuTScloud c5.x, and the myQNAPcloud 1.0.x service. Users are recommended to upgrade to the following versions, which address the three flaws: For QTS, QuTS hero, and QuTScloud, users must log in as administrators, navigate to 'Control Panel > System > Firmware Update,' and click 'Check for Update' to launch the automatic installation process. To update myQNAPcloud, log in as admin, open the 'App Center,' click on the search box, and type "myQNAPcloud" + ENTER. The update should appear in the results. Click on the 'Update' button to start. NAS devices often store large amounts of valuable data for businesses and individuals, including sensitive personal information, intellectual property, and critical business data. At the same time, they are not closely m...