CVE-2020-2506

improper access control vulnerability in Helpdesk

Exploited in attacks High 7.3 Attack chance: 2.0%

What it is

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

CISA: QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: April 15, 2022

Added to the CISA list: March 25, 2022
Published: February 3, 2021
Severity: High 7.3 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 2.0% in the top 19.5% of all known vulnerabilities
Weakness: CWE-284
More details: NVD · CVE.org · CISA

All references (1)

https://www.qnap.com/zh-tw/security-advisory/qsa-20-08

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.