New security vulnerabilities in web GUI and DLNA

[dolbyman]

https://securingsam.com/new-vulnerabili ... -takeover/

We discovered two critical vulnerabilities in QNAP TS-231’s latest firmware (version 4.3.6.1446 – 2020/09/29).

Web server: allows a remote attacker with access to the web server (default port 8080) to execute arbitrary shell commands, without prior knowledge of the web credentials.
DLNA server: allows a remote attacker with access to the DLNA server (default port 8200) to create arbitrary file data on any (non-existing) location, without any prior knowledge or credentials. It can also be elevated to execute arbitrary commands on the remote NAS as well.

We reported both vulnerabilities to QNAP with a 4-month grace period to fix them. Unfortunately, as of the publishing of this article, the vulnerabilities have not yet been fixed.

Still thinking exposing your NAS with disabled admin account and 2fa is enough? Think again!

[Moogle Stiltzkin]

eol but says it still receives security patches up to 2022
https://www.qnap.com/en/product/eol.php


4months? uh.... someone with this model best create a ticket to support.