CVE-2020-2506

high · 7.3Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-03-25Remediation due 2022-04-15

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

7.3

CVSS

2.0%

EPSS (exploit prob.)

80th

EPSS percentile

2021-02-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-284

Affected products

Vendor	Product	Affected versions
qnap	helpdesk	< 3.0.3

Check a specific version with /api/v1/cve/match.

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-08
https://www.qnap.com/zh-tw/security-advisory/qsa-20-08
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2506

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-2506