CVE-2009-3279: QNAP Ts-239 Pro Turbo NAS

Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days.

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create a LUKS partition by using the AES-256 cipher in plain CBC mode, which allows local users to obtain sensitive information via a watermark attack.

Affected products

• QNAP Ts-239 Pro Turbo NAS: version 2.1.7_0613 only; version 3.1.0_0627 only; version 3.1.1_0815 only
• QNAP Ts-639 Pro Turbo NAS: version 2.1.7_0613 only; version 3.1.0_0627 only; version 3.1.1_0815 only

Published 2009-09-21. Last modified 2026-06-16.