QNAP Newsroom

Taipei, Taiwan, February 25, 2021 - QNAP® Systems, Inc. (QNAP), a leading computing, networking and storage solution innovator, today urges its users to immediately update the Surveillance Station and Helpdesk apps to resolve certain recently-discovered security issues.

To ensure the security of their QNAP NAS, users are urged to install their applicable update(s) at the earliest convenience. To update the Surveillance Station app, follow the procedure outlined in QNAP Security Advisory QSA-21-07. To update the Helpdesk app, follow the procedure outlined in QNAP Security Advisory QSA-20-08. If further assistance is required, please contact QNAP at https://service.qnap.com/.

According to QNAP Security Advisory QSA-21-07, the stack buffer overflow of Surveillance Station allows attackers to execute arbitrary code if it is exploited. QNAP has already fixed this vulnerability in version 5.1.5.4.3 (for 64-bit systems) and 5.1.5.3.3 (for 32-bit systems) of Surveillance Station. According to QNAP Security Advisory QSA-20-08, the Helpdesk vulnerabilities allow attackers to obtain control of a QNAP device. QNAP has already fixed these vulnerabilities in version 3.0.3 of Helpdesk.

Alongside these software updates and published security advisories, QNAP has also sent individual notification emails to known Surveillance Station users, to minimize the impact caused by the issue. Corresponding product security news has also been released to ensure the transparency of QNAP's product security incident response.

The QNAP Product Security Incident Response Team (PSIRT) constantly monitors emerging developments to deliver up-to-date information and software updates, ensuring dependable data security for QNAP users. QNAP encourages its users to always use up-to-date versions of their software and to perform safe network usage habits to shield their devices from malicious software. QNAP also provides a best practice guide to assist users in improving their personal and organizational information security. By working together to fight cybersecurity threats, we make the Internet a safer place for everyone.