CVE-2024-21901
Published: 08 March 2024
Summary
CVE-2024-21901 is a medium-severity SQL Injection (CWE-89) vulnerability in Qnap Qts. Its CVSS base score is 4.7 (Medium).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A SQL injection vulnerability tracked as CVE-2024-21901 has been identified in myQNAPcloud. The flaw, assigned CWE-89, resides in the myQNAPcloud component and affects installations running on QTS. It carries a CVSS 3.1 base score of 4.7, indicating a network-accessible issue that requires high privileges.
Authenticated administrators can exploit the vulnerability over a network to inject arbitrary SQL commands. Successful exploitation could allow limited reading, modification, or disruption of data within the affected component, though the attack is constrained by the need for administrative credentials.
QNAP has released fixes in myQNAPcloud 1.0.52 dated November 24, 2023, and later, along with QTS 4.5.4.2627 build 20231225 and subsequent builds. The vendor's advisory QSA-24-09 recommends applying these updates to eliminate the exposure.
The associated EPSS score has remained flat at 0.0510 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19512
Vulnerability details
A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 ( 2023/11/24 )…
more
and later QTS 4.5.4.2627 build 20231225 and later
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.