QNAP Qes vulnerabilities

4 CVEs affecting QNAP Qes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2505, published 2020-12-24.

More from QNAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-2499, published 2020-12-24. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already…
• CVE-2020-2504, published 2020-12-24. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
• CVE-2020-2503, published 2020-12-24. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and…
• CVE-2020-2505, published 2020-12-24. Low severity, CVSS 2.3. EPSS: 0.3% chance of exploitation in the next 30 days. If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.