CVE-2020-2509Command Injection Vulnerability in QTS and QuTS hero
Updated under an hour ago ()
Does this affect you?
It affects QNAP Systems Inc. QTS and 3 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Apr 11, 2022; federal agencies had to remediate by May 2, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-77, CWE-78
- Known exploited
- Added to CISA KEV Apr 11, 2022; federal remediation due May 2, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 33.99% (percentile 98)
- Assigned by
- qnap
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
QNAP Systems Inc. QTS qnap_systems:qts (from the name) | from unspecified before 4.5.2.1566 Build 20210202; from unspecified before 4.5.1.1495 Build 20201123; from unspecified before 4.3.6.1620 Build 20210322; from unspecified before 4.3.4.1632 Build 20210324; from unspecified before 4.3.3.1624 Build 20210416; from unspecified before 4.2.6 Build 20210327 | CNA record |
QNAP Systems Inc. QuTS hero qnap_systems:quts_hero (from the name) | from unspecified before h4.5.1.1491 build 20201119 | CNA record |
qnap qts qnap:qts | before 4.2.6; from 4.3.5 before 4.3.6; from 4.4.0 before 4.5.1; 4.2.6; 4.2.6; 4.2.6; 4.2.6; 4.2.6; and 75 more ranges | NVD |
qnap quts_hero qnap:quts_hero | before h4.5.1; h4.5.1; h4.5.1.1472 | NVD |
References
- https://www.qnap.com/en/security-advisory/qsa-21-05x-refsource-misc, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2509us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.