What’s Vulnerable › Vulnerabilities

CVE-2024-21901: myQNAPcloud

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-08 · updated 2026-06-17
• Weakness: CWE-89

Description

A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: myQNAPcloud 1.0.52 ( 2023/11/24 ) and later QTS 4.5.4.2627 build 20231225 and later

Affected products

• myQNAPcloud Connect: before 1.0.52 — fixed in 1.0.52
• QNAP QTS: before 4.5.4.2627; 4.5.4.2627 — fixed in 4.5.4.2627

How to fix

Upgrade to a fixed version: myQNAPcloud Connect 1.0.52; QNAP QTS 4.5.4.2627. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/qsa-24-09
• https://www.qnap.com/en/security-advisory/qsa-24-09

Get alerted when CVE-2024-21901 or the next vulnerability affects your stack