CVE-2020-2509

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2020-2509
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-04-17 04:15:00 UTC
Updated2023-11-14 19:26:00 UTC
DescriptionA command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

Risk And Classification

EPSS: 0.328000000 probability, percentile 0.981770000 (date 2026-07-22)

CISA KEV: Listed on 2022-04-11; due 2022-05-02; ransomware use Unknown

Problem Types: CWE-77

CISA Known Exploited Vulnerability

VendorQNAP
ProductQNAP Network-Attached Storage (NAS)
NameQNAP Network-Attached Storage (NAS) Command Injection Vulnerability
Required ActionApply updates per vendor instructions.
Noteshttps://nvd.nist.gov/vuln/detail/CVE-2020-2509

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Qnap Qts 4.3.3.0174 All All All
Application Qnap Qts 4.3.3.0868 All All All
Application Qnap Qts 4.3.3.0998 All All All
Application Qnap Qts 4.3.3.1051 All All All
Application Qnap Qts 4.3.3.1098 All All All
Application Qnap Qts 4.3.3.1161 All All All
Application Qnap Qts 4.3.3.1252 All All All
Application Qnap Qts 4.3.3.1315 All All All
Application Qnap Qts 4.3.3.1386 All All All
Application Qnap Qts 4.3.3.1432 All All All
Operating System Qnap Qts All All All All
Operating System Qnap Qts 4.2.6 - All All
Operating System Qnap Qts 4.2.6 build_20170517 All All
Operating System Qnap Qts 4.2.6 build_20190322 All All
Operating System Qnap Qts 4.2.6 build_20190730 All All
Operating System Qnap Qts 4.2.6 build_20190921 All All
Operating System Qnap Qts 4.2.6 build_20191107 All All
Operating System Qnap Qts 4.2.6 build_20200109 All All
Operating System Qnap Qts 4.2.6 build_20200421 All All
Operating System Qnap Qts 4.2.6 build_20200611 All All
Operating System Qnap Qts 4.2.6 build_20200821 All All
Operating System Qnap Qts 4.3.3.0174 All All All
Operating System Qnap Qts 4.3.3.0868 All All All
Operating System Qnap Qts 4.3.3.0998 All All All
Operating System Qnap Qts 4.3.3.1051 All All All
Operating System Qnap Qts 4.3.3.1098 All All All
Operating System Qnap Qts 4.3.3.1161 All All All
Operating System Qnap Qts 4.3.3.1252 All All All
Operating System Qnap Qts 4.3.3.1315 All All All
Operating System Qnap Qts 4.3.3.1386 All All All
Operating System Qnap Qts 4.3.3.1432 All All All
Operating System Qnap Qts 4.3.4.0358 All All All
Operating System Qnap Qts 4.3.4.0358 beta1 All All
Operating System Qnap Qts 4.3.4.0370 All All All
Operating System Qnap Qts 4.3.4.0370 beta1 All All
Operating System Qnap Qts 4.3.4.0372 All All All
Operating System Qnap Qts 4.3.4.0372 beta1 All All
Operating System Qnap Qts 4.3.4.0374 All All All
Operating System Qnap Qts 4.3.4.0374 beta1 All All
Operating System Qnap Qts 4.3.4.0387 All All All
Operating System Qnap Qts 4.3.4.0387 beta2 All All
Operating System Qnap Qts 4.3.4.0411 All All All
Operating System Qnap Qts 4.3.4.0416 All All All
Operating System Qnap Qts 4.3.4.0427 All All All
Operating System Qnap Qts 4.3.4.0434 All All All
Operating System Qnap Qts 4.3.4.0435 All All All
Operating System Qnap Qts 4.3.4.0451 All All All
Operating System Qnap Qts 4.3.4.0483 All All All
Operating System Qnap Qts 4.3.4.0486 All All All
Operating System Qnap Qts 4.3.4.0506 All All All
Operating System Qnap Qts 4.3.4.0516 All All All
Operating System Qnap Qts 4.3.4.0526 All All All
Operating System Qnap Qts 4.3.4.0551 All All All
Operating System Qnap Qts 4.3.4.0557 All All All
Operating System Qnap Qts 4.3.4.0561 All All All
Operating System Qnap Qts 4.3.4.0569 All All All
Operating System Qnap Qts 4.3.4.0593 All All All
Operating System Qnap Qts 4.3.4.0597 All All All
Operating System Qnap Qts 4.3.4.0604 All All All
Operating System Qnap Qts 4.3.4.0899 All All All
Operating System Qnap Qts 4.3.4.1029 All All All
Operating System Qnap Qts 4.3.4.1082 All All All
Operating System Qnap Qts 4.3.4.1190 All All All
Operating System Qnap Qts 4.3.4.1282 All All All
Operating System Qnap Qts 4.3.4.1368 All All All
Operating System Qnap Qts 4.3.4.1417 All All All
Operating System Qnap Qts 4.3.4.1463 All All All
Operating System Qnap Qts 4.3.6 - All All
Operating System Qnap Qts 4.3.6.0895 All All All
Operating System Qnap Qts 4.3.6.0907 All All All
Operating System Qnap Qts 4.3.6.0923 All All All
Operating System Qnap Qts 4.3.6.0944 All All All
Operating System Qnap Qts 4.3.6.0959 All All All
Operating System Qnap Qts 4.3.6.0979 All All All
Operating System Qnap Qts 4.3.6.0993 All All All
Operating System Qnap Qts 4.3.6.1013 All All All
Operating System Qnap Qts 4.3.6.1033 All All All
Operating System Qnap Qts 4.3.6.1070 All All All
Operating System Qnap Qts 4.3.6.1154 All All All
Operating System Qnap Qts 4.3.6.1218 All All All
Operating System Qnap Qts 4.3.6.1263 All All All
Operating System Qnap Qts 4.3.6.1286 All All All
Operating System Qnap Qts 4.3.6.1333 All All All
Operating System Qnap Qts 4.3.6.1411 All All All
Operating System Qnap Qts 4.3.6.1446 All All All
Operating System Qnap Qts 4.5.1 - All All
Operating System Qnap Qts 4.5.1.1456 All All All
Operating System Qnap Qts 4.5.1.1461 All All All
Operating System Qnap Qts 4.5.1.1465 All All All
Operating System Qnap Qts 4.5.1.1480 All All All
Operating System Qnap Qts 4.5.2 - All All
Application Qnap Quts Hero All All All All
Application Qnap Quts Hero h4.5.1 - All All
Application Qnap Quts Hero h4.5.1.1472 All All All
Operating System Qnap Quts Hero All All All All
Operating System Qnap Quts Hero h4.5.1 - All All
Operating System Qnap Quts Hero h4.5.1.1472 All All All

References

ReferenceSourceLinkTags
Command Injection Vulnerability in QTS and QuTS hero - Security Advisory | QNAP MISC www.qnap.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
CISA Known Exploited Vulnerabilities catalog CISA www.cisa.gov kev

Vendor Comments And Credit

Discovery Credit

LEGACY: Omri Mallis, Yaniv Puyeski

Legacy QID Mappings

  • 731242 QNAP QTS Command Injection Vulnerability (QSA-21-05)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report