CVE-2024-21900
published 2024-03-08CVE-2024-21900: An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users…
PriorityP349medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
9.41%
94.8th percentile
An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later
QuTScloud c5.1.5.2651 and later
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| qnap | qts | < 5.1.3.2578 | 5.1.3.2578 |
| qnap | qts | — | — |
| qnap | quts_hero | < h5.1.3.2578 | h5.1.3.2578 |
| qnap | quts_hero | — | — |
| qnap | qutscloud | < c5.1.5.2651 | c5.1.5.2651 |
| qnap_systems_inc | qts | >= 5.1.x < 5.1.3.2578 build 20231110 | 5.1.3.2578 build 20231110 |
| qnap_systems_inc | quts_hero | >= h5.1.x < h5.1.3.2578 build 20231110 | h5.1.3.2578 build 20231110 |
| qnap_systems_inc | qutscloud | >= c5.x.x < c5.1.5.2651 | c5.1.5.2651 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Checkpoint
11th March – Threat Intelligence Report
blogs_checkpoint·2024-03-11·CVSS 8.2
CVE-2023-46805 [HIGH] 11th March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 11th March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 11th March, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Cybersecurity and Infrastructure Security Agency (CISA) has taken offline two systems following a breach that occurred as a result of the recent vulnerabilities exploitation in Ivanti products. The affected systems potentially include the Infrastructure Protection Gateway and the Chemical Security Assessment Tool, holding sen
Bleepingcomputer
QNAP warns of critical auth bypass flaw in its NAS devices
blogs_bleepingcomputer·2024-03-08·CVSS 9.8
[CRITICAL] QNAP warns of critical auth bypass flaw in its NAS devices
## QNAP warns of critical auth bypass flaw in its NAS devices
## Bill Toulas
QNAP warns of vulnerabilities in its NAS software products, including QTS, QuTS hero, QuTScloud, and myQNAPcloud, that could allow attackers to access devices.
The Taiwanese Network Attached Storage (NAS) device maker disclosed three vulnerabilities that can lead to an authentication bypass, command injection, and SQL injection.
While the last two require the attackers to be authenticated on the target system, which significantly lessens the risk, the first (CVE-2024-21899) can be executed remotely without authentication and is marked as "low complexity."
The three flaws fixed are the following:
CVE-2024-21899 : Improper authentication mechanisms allow unauthorized users to compromise the system's security t
2024-03-08
Published