Security Advisory for OpenSSL Vulnerability in QTS

Summary

A reported OpenSSL vulnerability may affect QNAP NAS devices running QTS 4.4.1 build 20190818, QTS 4.3.6 build 20190813, and earlier versions. If exploited, the vulnerability may allow attackers to run arbitrary code in OpenSSL on the NAS.

We have already fixed this issue in the following QTS versions:

• QTS 4.4.1: build 20190918 and later
• QTS 4.3.6: build 20190919 and later

Recommendation

To fix the vulnerability, we recommend updating QTS to the latest version.

Installing the QTS Update

1. Log on to QTS as an administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   QTS downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your device.