====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN322
_____________________________________________________________________

DATE                : 14/06/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Certain QNAP Switches.

=====================================================================
https://www.qnap.com/fr-fr/security-advisory/qsa-21-23
https://www.qnap.com/fr-fr/security-advisory/qsa-21-24
_____________________________________________________________________

Out-of-Bounds Read Vulnerability in QSS

    Release date: June 11, 2021
    Security ID: QSA-21-23
    Severity: Low
    CVE identifier: CVE-2021-28801
    Affected products: Certain QNAP Switches
    Status: Resolved


Summary

An out-of-bounds read vulnerability has been reported to affect certain
QNAP switches running QSS. If exploited, this vulnerability allows
attackers to read sensitive information on the system.

We have already fixed this vulnerability in the following versions:

    QSW-M2108-2C: QSS 1.0.2 build 20210122 and later
    QSW-M2108-2S: QSS 1.0.2 build 20210122 and later
    QSW-M2108R-2C: QSS 1.0.2 build 20210122 and later


Recommendation

To secure your device, we recommend regularly updating your system to
the latest version to benefit from vulnerability fixes.


Updating QSS

    Log on to QSS.
    Go to System > Firmware Update > Live Update.
    Click Check for Update.
    QSS checks for available firmware updates.
    Click Update System.
    A confirmation message appears.
    Click Update.
    QSS downloads and installs the latest available update.


Tip: You can also download the update from the QNAP website. Go to
Support > Download Center and then perform a manual update for your
specific device.


Acknowledgements: Qian Chen from Codesafe Team of Legendsec at Qi'anxin
Group


Revision History: V1.0 (June 11, 2021) - Published

_____________________________________________________________________

Inclusion of Sensitive Information in QSS

    Release date: June 11, 2021
    Security ID: QSA-21-24
    Severity: High
    CVE identifier: CVE-2021-28805
    Affected products: Certain QNAP Switches
    Status: Resolved


Summary

Inclusion of sensitive information in the source code has been reported
to affect certain QNAP switches running QSS. If exploited, this
vulnerability allows attackers to read application data.

We have already fixed this vulnerability in the following versions:

    QSW-M2108-2C: QSS 1.0.3 build 20210505 and later
    QSW-M2108-2S: QSS 1.0.3 build 20210505 and later
    QSW-M2108R-2C: QSS 1.0.3 build 20210505 and later
    QSW-M408: QSS 1.0.12 build 20210506 and later


Recommendation

To secure your device, we recommend regularly updating your system to
the latest version to benefit from vulnerability fixes.

Updating QSS

    Log on to QSS.
    Go to System > Firmware Update > Live Update.
    Click Check for Update.
    QSS checks for available firmware updates.
    Click Update System.
    A confirmation message appears.
    Click Update.
    QSS downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to
Support > Download Center and then perform a manual update for your
specific device.


Acknowledgements: Jan Hoff

Revision History: V1.0 (June 11, 2021) - Published


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================