QNAP QTS and QuTS hero CRLF Injection Vulnerability Allowing Data Modification

A CRLF injection vulnerability has been identified in multiple QNAP operating system versions, specifically QTS 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with user access to improperly manipulate application data. The issue arises from inadequate handling of CRLF sequences, which could be exploited to alter how data is processed or displayed.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of application data.

Remediation

Users can update to QTS 5.2.3.3006 build 20250108 or later, or QuTS hero h5.2.3.3006 build 20250108 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.