Qnap reports three critical vulnerabilities in its NAS systems. There is an update available that everyone should install now.

Taiwanese Qnap reports that three vulnerabilities were found in the operating system of NAS devices. The most serious is CVE-2024-21899, which allows hackers to bypass the authentication process in QTS 5.1. Together with the other two vulnerabilities CVE-2024-21900 and CVE-2024-21901, hackers could potentially inject malicious code and execute commands on a NAS.

Qnap emphasizes that these are critical leaks and an update is very important. These operating systems are affected:

It goes without saying that every online device needs regular updates. Especially with Qnap, you can do this easily in QTS, QuTS hero or QuTScloud via the web interface. Go to Control panel, system and choose Firmware update. Choose below Live update the option to check for updates. Then the latest version, which is more secure, will be installed automatically.

This is not the first time that Qnap has struggled with critical vulnerabilities. At the end of last year, the company had to quickly close two critical vulnerabilities, after also having to raise the alarm with a new patch for a critical vulnerability in early 2023.