CVE-2020-2507: command injection vulnerability in Helpdesk

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-03 · updated 2026-06-17
Weakness: CWE-77

Description

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

Affected products

QNAP Systems Inc. Helpdesk: before 3.0.3 — fixed in 3.0.3

How to fix

Upgrade to a fixed version: QNAP Systems Inc. Helpdesk 3.0.3. Check the vendor advisory for mitigations.

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-08
https://www.qnap.com/zh-tw/security-advisory/qsa-20-08

Get alerted when CVE-2020-2507 or the next vulnerability affects your stack