CVE-2020-2509

QNAP NAS devices suffered a command injection vulnerability enabling remote code execution, actively exploited in ransomware campaigns.

QNAP NAS devices contained a command injection flaw allowing attackers to execute arbitrary code remotely. This vulnerability was actively exploited in the wild, leading to data breaches and system compromises, particularly in ransomware attacks. DIB organizations must ensure their storage infrastructure is patched and monitored for signs of exploitation, as QNAP has a history of critical, unpatched vulnerabilities.

Shame score — The vulnerability was actively exploited in ransomware campaigns, indicating a severe failure in patch management and security posture that directly led to data breaches and system compromises.