Actively exploited · Published Feb 3, 2021 · Assigned by qnap

CVE-2020-2506improper access control vulnerability in Helpdesk

High 7.3 Exploited

In plain English

A high-severity improper access control in Helpdesk from QNAP Systems Inc.. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)2.0%top 19.1% of all CVEs

Exploited in the wildYesCISA KEV since Mar 25, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	Helpdesk	unspecified – before 3.0.3

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-08 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2506 government-resource