Experts released PoC exploit code for a critical RCE in QNAP NAS devices

The exploit code for a remote code execution vulnerability affecting QNAP network-attached storage (NAS) devices that run the Surveillance Station video management system is available online.

An exploit for a remote code execution vulnerability affecting QNAP network-attached storage (NAS) devices was publicly released.

The vulnerability, tracked as CVE-2020-2501, is a stack-based buffer overflow issue that affects QNAP NAS devices running Surveillance Station versions 5.1.5.4.2 and 5.1.5.3.2.

“A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code.” reads the advisory published by the Taiwanese vendor in February.

“We have already fixed this vulnerability in the following versions:

• Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS)
• Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS)”

The flaw could be exploited by remote, unauthenticated attackers to execute arbitrary code on a vulnerable device.

The vulnerability was reported by an independent researcher, not details about its exploitation were publicly disclosed.

This week, the security firm SSD Secure Disclosure provided additional details on the flaw and released a PoC exploit code for this flaw.

“QNAP NAS with “Surveillance Station Local Display function can perform monitoring and playback by using an HDMI display to deliver live Full HD (1920×1080) video monitoring”.” states SSD Secure Disclosure.

“Insecure use of user supplied data sent to the QNAP NAS device can be exploited to run arbitrary code by overflowing an internal buffer used by the Surveillance Station plugin.”

The vulnerability could be exploited by attackers by sending a specially crafted HTTP request to a vulnerable QNAP NAS device, which would trigger an internal buffer overflow and could lead to arbitrary code execution.

The flaw could be addressed by updating the Surveillance Station to the latest version.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, QNAP)

The post Experts released PoC exploit code for a critical RCE in QNAP NAS devices appeared first on Security Affairs.