CVE-2009-3200

Severity: medium (CVSS 5.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-09-21 · updated 2026-06-16
Weakness: CWE-310

Description

The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable, deobfuscating the key, and running a cryptsetup luksOpen command.

Affected products

QNAP Ts-239 Pro Turbo Nas: 2.1.7_0613, 3.1.0_0627, 3.1.1_0815
QNAP Ts-639 Pro Turbo Nas: 2.1.7_0613, 3.1.0_0627, 3.1.1_0815

References

http://forum.qnap.com/viewtopic.php?f=11&t=11214&start=20#p63346
http://forum.qnap.com/viewtopic.php?f=12&t=12104&start=10#p63341
http://secunia.com/advisories/36793
http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt
http://www.securityfocus.com/archive/1/506607/100/0/threaded
http://www.securityfocus.com/bid/36467
http://www.securitytracker.com/id?1022916
https://exchange.xforce.ibmcloud.com/vulnerabilities/53391
http://forum.qnap.com/viewtopic.php?f=11&t=11214&start=20#p63346
http://forum.qnap.com/viewtopic.php?f=12&t=12104&start=10#p63341
http://secunia.com/advisories/36793
http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt

Get alerted when CVE-2009-3200 or the next vulnerability affects your stack