Project Hyphae

Oh Snap! QNAP

Share This Post


Thousands of QNAP network-attached storage (NAS) devices have a critical security flaw that needs to be patched.

QNAP has stated that the vulnerability affects QNAP devices running QTS 5.0.1 and QuTS hero h5.0.1.
If exploited, this vulnerability allows remote attackers to inject malicious code.

QNAP claims to have already fixed this vulnerability in the following operating system versions:

  • QTS build 20221201 and later
  • QuTS hero h5.0.1.2248 build 20221215 and later

If exploited, the vulnerability would allow remote actors to inject malicious code into Internet-exposed, unpatched QNAP devices through a SQL injection vulnerability.

It is important for QNAP customers to patch their NAS devices before threat actors can exploit the vulnerability, as NAS devices have been targeted by multiple ransomware strains in recent years.

In addition to updating, customers should also consider not exposing their devices online to prevent remote exploitation, and if a device needs to be accessible online, make sure to harden and limit access to the device as much as possible. FRSecure recommends that for remote access to such devices, securing them behind a VPN, and utilizing modern authentication methods, unique credentials and MFA, is best.

Reach out to our incident response team for help

More To Explore

Information Security News 9-18-2023

Iranian Cyberspies Target Thousands of Organizations with Password Spray Attacks Article Link: Requests via Facebook Messenger Lead to Hijacked Business Accounts Article Link:

Information Security News 9-11-2023

University of Michigan Requires Password Resets After Cyberattack Article Link: Attackers Accessed UK Military Data Through High-Security Fencing Firm’s Windows 7 Rig Article Link:

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.