QNAP Helpdesk vulnerabilities

11 CVEs affecting QNAP Helpdesk, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-50394, published 2025-03-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-2506: QNAP Helpdesk Improper Access Control Vulnerability, published 2021-02-03. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 2% chance of exploitation in the next 30 days. The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by…
CVE-2020-2507, published 2021-02-03. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects:…
CVE-2018-0714, published 2018-08-13. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 and their earlier versions could allow…
CVE-2018-0728, published 2019-12-04. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and Helpdesk to their latest versions.
CVE-2021-28814, published 2021-06-11. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to compromise the security of the software. This issue affects:…
CVE-2018-19947, published 2020-09-11. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive information. QNAP has already fixed the…
CVE-2020-2500, published 2020-07-01. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have…
CVE-2018-19946, published 2020-09-11. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by…
CVE-2024-50394, published 2025-03-07. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. An improper certificate validation vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have…
CVE-2018-19948, published 2020-09-11. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow attackers to force NAS users to execute…

Latest

CVE-2024-27125, published 2024-09-06. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We…