Regarding the recently reported vulnerabilities on the QNAP® Turbo NAS with Surveillance Station Pro App/QPKG installed, QNAP has updated the Surveillance Station Pro App/QPKG and suggested that the affected Turbo NAS users immediately update to the newest version.
1. QNAP Turbo NAS with system firmware 3.8 and Surveillance Station Pro v2.0 to 2.5 installed.
2. QNAP Turbo NAS with QTS 4.0 and Surveillance Station Pro v3.0.0 installed.
These vulnerabilities do not exist if Surveillance Station Pro is not installed on Turbo NAS. No fix is required in this case.
• CWE-284: Improper Access Control CVE-2013-0142
• CWE-77: Improper Neutralization of Special Elements used in a Command CVE-2013-0143
• CWE-352: Cross-Site Request Forgery (CSRF). CVE-2013-0144
Please visit kb.cert.org for more information.
For QNAP Turbo NAS with system firmware QTS 4.0 and Surveillance Station Pro v3.0.0 installed, please go to App Center and upgrade Surveillance Station Pro to v3.0.2 or higher.
For QNAP Turbo NAS with system firmware 3.8 and Surveillance Station Pro v2.0 - 2.5 installed, please go to QPKG Center and upgrade Surveillance Station Pro to v2.6 or higher.
1. For any further inquiries, please contact us by email sspro[.]qnap.com
2. For VioStor NVR vulnerabilities, please visit VioStor forum to get the hot-fix firmware.
“We are dedicated to providing secure and reliable solutions to our users,” said Jason Hsu, product manager of QNAP. “Our prompt response to any possible security concern is a commitment to this belief,” added Hsu.
QNAP Systems, Inc. (qnap.com), as its brand promise "Quality Network Appliance Provider", aims to deliver comprehensive offerings of cutting edge network attached storage (NAS) and network video recorder (NVR) solutions featured with ease-of-use, robust operation, large storage capacity, and trustworthy reliability. QNAP integrates technologies and designs to bring forth quality products that effectively improve business efficiency on file sharing, virtualization applications, storage management and surveillance in the business environments, as well as enrich entertainment life for home users with the offering of a fun multimedia center experience. Headquartered in Taipei, QNAP delivers its solutions to the global market with nonstop innovation and passion.