Pierluigi Paganini
October 30, 2024
QNAP addressed a critical zero-day vulnerability, tracked as CVE-2024-50388, which was exploited by white hat hackers against a TS-464 NAS device during the recent Pwn2Own Ireland 2024 hacking competition.
The flaw is an OS command injection vulnerability in HBS 3 Hybrid Backup Sync, a remote attacker could exploit it to execute arbitrary code commands on vulnerable devices.
The vulnerability impacts version 25.1.x and was addressed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later
“An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.” reads the advisory published by the Taiwanese manufacturer.
On Day three of the Pwn2Own Ireland 2024 competition, Ha The Long with Ha Anh Hoang of Viettel Cyber Security (@vcslab) used a single command injection bug to exploit the QNAP TS-464 NAS. Their fourth-round win nets them $10,000 and 4 Master of Pwn points.
Despite vendors have 90 days until Trend Micro’s Zero Day Initiative publicly discloses details on exploits demonstrated during the contest, QNAP quickly addressed it.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, TS-464 NAS)
