ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Keywords match titles. Record type separates incidents, intel, and research from CVEs.

  1. Research · Dec 11, 2023 · ZeroDay Catalog

    Critical OS Command Injection Vulnerability in QNAP VioStor NVR

    A significant OS command injection vulnerability has been identified in legacy QNAP VioStor NVR models, requiring immediate attention from affected users.

    What changed

    An OS command injection vulnerability has been discovered in legacy QNAP VioStor NVR models that utilize QVR Firmware 4.x. This flaw allows authenticated users to execute arbitrary commands over the network, posing a serious security risk.

    QNAP has addressed this vulnerability in QVR Firmware version 5.0.0 and later, making it crucial for users to update their systems promptly.

    Who is affected

    The vulnerability impacts several groups and products, particularly those utilizing outdated firmware versions.

    Affected parties include:

    • Users of legacy QNAP VioStor NVR models running QVR Firmware 4.x.
    • Organizations relying on QNAP for video surveillance solutions.
    • IT administrators managing QNAP devices within their networks.
    • Any entities that have not yet upgraded to QVR Firmware 5.0.0 or later.

    What to do

    To mitigate the risks associated with this vulnerability, immediate action is recommended.

    Users should ensure they upgrade to QVR Firmware version 5.0.0 or later to protect their systems from potential exploitation.

    • Review current firmware versions on all QNAP VioStor NVR devices.
    • Implement the firmware upgrade to the latest version as soon as possible.
    • Monitor network activity for any unauthorized command executions.
    • Consider additional security measures, such as network segmentation and access controls.

    Original report

  2. Research · Dec 6, 2023 · ZeroDay Catalog

    OS Command Injection Vulnerability in FXC AE1021 and AE1021PE Firmware

    A critical OS command injection vulnerability has been identified in FXC AE1021 and AE1021PE firmware, affecting versions 2.0.9 and earlier.

    What changed

    An OS command injection vulnerability has been discovered in the firmware of FXC AE1021 and AE1021PE devices. This vulnerability allows an attacker with login access to execute arbitrary OS commands, potentially compromising the integrity and security of the affected systems.

    • The vulnerability is present in AE1021PE firmware version 2.0.9 and earlier.
    • The vulnerability is also found in AE1021 firmware version 2.0.9 and earlier.
    • Successful exploitation could lead to unauthorized access and control over the affected devices.

    Who is affected

    Organizations utilizing FXC AE1021 and AE1021PE products should be aware of their exposure to this vulnerability. It is crucial to assess the impact on their operational environment.

    • Users of FXC AE1021 firmware version 2.0.9 and earlier.
    • Users of FXC AE1021PE firmware version 2.0.9 and earlier.
    • Organizations relying on these devices for critical operations.

    What to do

    To mitigate the risks associated with this vulnerability, affected users should take immediate action to secure their systems. Upgrading to the latest firmware version is essential.

    • Upgrade to the latest firmware version provided by FXC to eliminate the vulnerability.
    • Restrict access to the devices to authorized personnel only.
    • Monitor system logs for any unauthorized access attempts.

    Original report