CVE-2020-2506highunder attackCWE-284

CVE-2020-2506: high-severity vulnerability in QNAP Systems Inc. Helpdesk

improper access control vulnerability in Helpdesk

Published · Updated

Follow this CVE+ Monitor Helpdesk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.3epss 2.0%
from disclosure to weapon
Published on NVDFeb 3
CISA KEV+415d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

A flaw in QNAP Helpdesk allows attackers to bypass access controls and gain unauthorized privileges or read sensitive data. This happens because the software doesn't properly check who should be allowed to access certain features.

Technical detail

Improper access control (CWE-284) in QNAP Helpdesk versions before 3.0.3 permits attackers to escalate privileges or access restricted information without proper authentication or authorization checks. The vulnerability stems from insufficient validation of user permissions, enabling unauthorized access to sensitive functionality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
QNAP Systems Inc. · Helpdesk
Related CVEs — QNAP Systems Inc. Helpdesk

In the same product, most dangerous first.

CVE-2020-2507CRITICALcommand injection vulnerability in HelpdeskEPSS 3.1%CVE-2021-28814HIGHImproper Access Control Vulnerability in HelpdeskEPSS 1.2%CVE-2018-19947MEDIUMCVE-2018-19947EPSS 0.8%CVE-2020-2500CRITICALCVE-2020-2500EPSS 0.7%CVE-2018-19946MEDIUMCVE-2018-19946EPSS 0.3%CVE-2024-50394HIGHHelpdeskEPSS 0.3%