QNAP patches critical SQLi flaw
Take action: If you are running QNAP NAS devices, consider them vulnerable and start patching. Even if isolated from the internet, they can still be attacked since they are serving multiple users whose endpoints may be compromised.
Learn More
QNAP has issued patches for a critical SQL injection vulnerability discovered during the Pwn2Own Ireland 2024 event.
The flaw is tracked as CVE-2024-50387 (CVSS score not assigned) in QNAP's SMB Service allowed security researchers from YingMuo, associated with the DEVCORE Internship Program, to obtain root access on a QNAP TS-464 NAS device. Rated critical, the vulnerability was rapidly addressed in SMB Service versions 4.15.002 or later and h4.15.002 or later.
In addition to CVE-2024-50387, QNAP also fixed another zero-day vulnerability found in its HBS 3 Hybrid Backup Sync solution (CVE not assigned). This issue, exploited by Viettel Cyber Security’s team at the same Pwn2Own event, enabled arbitrary command execution on the same TS-464 NAS device model. Viettel’s successful exploit contributed to their overall win at Pwn2Own, where more than $1 million in awards were given for exposing over 70 unique zero-day vulnerabilities.
QNAP devices are high-value targets for ransomware campaigns, often used for sensitive data storage and backup. Users are strongly encouraged to update their NAS systems immediately by accessing the App Center, searching for "SMB Service," and installing available updates.
