CVE-2020-2506

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 2,0%

Kerentanan Improper Access Control pada qnap helpdesk. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

Rincian

Terbit di NVD

3 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

QNAP Helpdesk Improper Access Control Vulnerability

Masuk KEV

25 Maret 2022

Tenggat CISA

15 April 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.qnap.com/zh-tw/security-advisory/qsa-20-08 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2506 pemerintah AS