CVE-2020-2509

Command Injection Vulnerability in QTS and QuTS hero

CRITICAL

9.8

CVSS Score

Published: April 17, 2021 at 03:50 AM UTC

Updated: June 17, 2026 at 03:12 AM UTC

2 products affected across 1 vendorQTSQuTS hero

Using QTS by QNAP Systems Inc.?

Get instant alerts when new vulnerabilities affect QTS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploitation

CISA KEV

Exploit prediction

EPSS 34%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score34.0%

EPSS (Exploit Prediction Scoring System) estimates a 34.0% chance this CVE is exploited in the wild within the next 30 days — higher than 98% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.

Required Action

Apply updates per vendor instructions.

Ransomware Use

Unknown

Added to KEV

Apr 11, 2022

Remediation Due

May 2, 2022

1642 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2020-2509

Description

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

QTS · Qnap

95%

v < 4.2.6v < 4.2.6 Build 20210327v < 4.3.3.1624 Build 20210416v < 4.3.4.1632 Build 20210324v < 4.3.6.1620 Build 20210322v < 4.5.1.1495 Build 20201123v < 4.5.2.1566 Build 202102024.3.5 ≤ v < 4.3.64.4.0 ≤ v < 4.5.14.2.6 4.2.6 build_20170517 4.2.6 build_20190322 4.2.6 build_20190730 4.2.6 build_20190921 4.2.6 build_20191107 4.2.6 build_20200109 4.2.6 build_20200421 4.2.6 build_20200611 4.2.6 build_20200821 4.3.3.0174 4.3.3.0868 4.3.3.0998 4.3.3.1051 4.3.3.1098 4.3.3.1161 4.3.3.1252 4.3.3.1315 4.3.3.1386 4.3.3.1432 4.3.4.0358 4.3.4.0358 beta1 4.3.4.0370 4.3.4.0370 beta1 4.3.4.0372 4.3.4.0372 beta1 4.3.4.0374 4.3.4.0374 beta1 4.3.4.0387 4.3.4.0387 beta2 4.3.4.0411 4.3.4.0416 4.3.4.0427 4.3.4.0434 4.3.4.0435 4.3.4.0451 4.3.4.0483 4.3.4.0486 4.3.4.0506 4.3.4.0516 4.3.4.0526 4.3.4.0551 4.3.4.0557 4.3.4.0561 4.3.4.0569 4.3.4.0593 4.3.4.0597 4.3.4.0604 4.3.4.0899 4.3.4.1029 4.3.4.1082 4.3.4.1190 4.3.4.1282 4.3.4.1368 4.3.4.1417 4.3.4.1463 4.3.6 4.3.6.0895 4.3.6.0907 4.3.6.0923 4.3.6.0944 4.3.6.0959 4.3.6.0979 4.3.6.0993 4.3.6.1013 4.3.6.1033 4.3.6.1070 4.3.6.1154 4.3.6.1218 4.3.6.1263 4.3.6.1286 4.3.6.1333 4.3.6.1411 4.3.6.1446 4.5.1 4.5.1.1456 4.5.1.1461 4.5.1.1465 4.5.1.1480 4.5.2

Affected range stops below 4.2.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.2.6 Build 20210327, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.3.1624 Build 20210416, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.4.1632 Build 20210324, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.6.1620 Build 20210322, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5.1.1495 Build 20201123, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.5.2.1566 Build 20210202, so it looks safe — our inference, not a vendor statement

QuTS hero · Qnap

95%

v < h4.5.1v < h4.5.1.1491 build 20201119h4.5.1 h4.5.1.1472

Affected range stops below h4.5.1, so it looks safe — our inference, not a vendor statement

Affected range stops below h4.5.1.1491 build 20201119, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.qnap.com/en/security-advisory/qsa-21-05

References (2)

x_refsource_MISCVendor Advisory

Source: [email protected]

https://www.qnap.com/en/security-advisory/qsa-21-05

US Government Resource

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2509

SSVC — Action Prioritization

SSVCActiveAutomatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

9.8CRITICALCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-77CWE-78

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card