Project Hyphae

Oh Snap! QNAP

Share This Post


Thousands of QNAP network-attached storage (NAS) devices have a critical security flaw that needs to be patched.

QNAP has stated that the vulnerability affects QNAP devices running QTS 5.0.1 and QuTS hero h5.0.1.
If exploited, this vulnerability allows remote attackers to inject malicious code.

QNAP claims to have already fixed this vulnerability in the following operating system versions:

  • QTS build 20221201 and later
  • QuTS hero h5.0.1.2248 build 20221215 and later

If exploited, the vulnerability would allow remote actors to inject malicious code into Internet-exposed, unpatched QNAP devices through a SQL injection vulnerability.

It is important for QNAP customers to patch their NAS devices before threat actors can exploit the vulnerability, as NAS devices have been targeted by multiple ransomware strains in recent years.

In addition to updating, customers should also consider not exposing their devices online to prevent remote exploitation, and if a device needs to be accessible online, make sure to harden and limit access to the device as much as possible. FRSecure recommends that for remote access to such devices, securing them behind a VPN, and utilizing modern authentication methods, unique credentials and MFA, is best.

More To Explore

Information Security News 6-5-2023

‘Picture-in-Picture’ Obfuscation Spoofs Delta, Kohl’s for Credential Harvesting Article Link: NSA and FBI: Kimsuky Hackers Pose as Journalists to Steal Intel Article Link:

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.