Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-21901 is a medium-severity SQL Injection (CWE-89) vulnerability in Qnap Qts. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Protocol or Service Impersonation (T1001.003); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A SQL injection vulnerability tracked as CVE-2024-21901 has been identified in myQNAPcloud. The flaw, assigned CWE-89, resides in the myQNAPcloud component and affects installations running on QTS. It carries a CVSS 3.1 base score of 4.7, indicating a network-accessible issue that requires high privileges.
Authenticated administrators can exploit the vulnerability over a network to inject arbitrary SQL commands. Successful exploitation could allow limited reading, modification, or disruption of data within the affected component, though the attack is constrained by the need for administrative credentials.
QNAP has released fixes in myQNAPcloud 1.0.52 dated November 24, 2023, and later, along with QTS 4.5.4.2627 build 20231225 and subsequent builds. The vendor's advisory QSA-24-09 recommends applying these updates to eliminate the exposure.
The associated EPSS score has remained flat at 0.0510 with no material increase since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19512
Vulnerability Data
A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 ( 2023/11/24 )…
more
and later QTS 4.5.4.2627 build 20231225 and later
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover SQLi flaws before deployment but does not stop their introduction.
Input validation directly stops untrusted data from reaching SQL query construction without neutralization.
Secure engineering principles require parameterized queries and input sanitization that structurally eliminate SQLi.
System monitoring can identify attempted SQLi exploitation via anomalous queries after the weakness exists.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.6 only improves knowledge flow, awareness of threats/patches and access to specialist advice; it does not stop SQL injection from being exploitable in code that still contains the flaw.