QNAP fixed NAS backup zero-day demonstrated at Pwn2Own Ireland 2024

QNAP fixed critical zero-day CVE-2024-50388 which was demonstrated against a TS-464 NAS device during the Pwn2Own Ireland 2024 competition.

QNAP addressed a critical zero-day vulnerability, tracked as CVE-2024-50388, which was exploited by white hat hackers against a TS-464 NAS device during the recent Pwn2Own Ireland 2024 hacking competition.

The flaw is an OS command injection vulnerability in HBS 3 Hybrid Backup Sync, a remote attacker could exploit it to execute arbitrary code commands on vulnerable devices.

The vulnerability impacts version 25.1.x and was addressed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later

“An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.” reads the advisory published by the Taiwanese manufacturer.

On Day three of the Pwn2Own Ireland 2024 competition, Ha The Long with Ha Anh Hoang of Viettel Cyber Security (@vcslab) used a single command injection bug to exploit the QNAP TS-464 NAS. Their fourth-round win nets them $10,000 and 4 Master of Pwn points.

Despite vendors have 90 days until Trend Micro’s Zero Day Initiative publicly discloses details on exploits demonstrated during the contest, QNAP quickly addressed it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, TS-464 NAS)