CVE-2009-3278: QNAP Ts-239 Pro Firmware

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack.

Affected products

• QNAP Ts-239 Pro Firmware: version 2.1.7 only; version 3.1.0 only; version 3.1.1 only
• QNAP Ts-639 Pro Firmware: version 2.1.7 only; version 3.1.0 only; version 3.1.1 only

Published 2009-09-21. Last modified 2026-06-16.