CVE-2020-2504
Absolute path traversal vulnerability in QES
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.8EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
24 Dec 2020Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected products
QNAP Systems Inc. · QESWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →