QNAP removes backdoor account in NAS backup, disaster recovery app

guest · Apr 22, 2021

QNAP removes backdoor account in NAS backup, disaster recovery app
April 22, 2021
https://www.bleepingcomputer.com/ne...-account-in-nas-backup-disaster-recovery-app/

QNAP has addressed a critical vulnerability allowing attackers to log into QNAP NAS (network-attached storage) devices using hardcoded credentials.

The hard-coded credentials vulnerability tracked as CVE-2021-28799 was found by Taiwan-based ZUSO APT in HBS 3 Hybrid Backup Sync, the company's disaster recovery and data backup solution.
Click to expand...

While QNAP published the security announcing that CVE-2021-28799 was fixed today, the app's release notes for version 16.0.0415 lists it as fixed almost a week ago, on April 16th.

A QNAP spokesperson told BleepingComputer that the disclosure delay was caused by the additional time needed to release patches for QuTS hero and QuTScloud HBS versions (the security update for QTS was released six days ago).

QNAP also added that its PSIRT team has not found evidence of active exploitation of this vulnerability in the wild.
Click to expand...

Log in or Sign up

QNAP removes backdoor account in NAS backup, disaster recovery app

guest Guest

Log in or Sign up

QNAP removes backdoor account in NAS backup, disaster recovery app

guest Guest

Useful Searches