Out-of-Bounds Read Vulnerability in QSS

Summary

An out-of-bounds read vulnerability has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read sensitive information on the system.

We have already fixed this vulnerability in the following versions:

• QSW-M2108-2C: QSS 1.0.2 build 20210122 and later
• QSW-M2108-2S: QSS 1.0.2 build 20210122 and later
• QSW-M2108R-2C: QSS 1.0.2 build 20210122 and later

Recommendation

To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes.

Updating QSS

1. Log on to QSS.
2. Go to System > Firmware Update > Live Update.
3. Click Check for Update.
   QSS checks for available firmware updates.
4. Click Update System.
   A confirmation message appears.
5. Click Update.
QSS downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.