CVE-2020-2509: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

CISA Known Exploited Vulnerabilities

Name

QNAP Network-Attached Storage (NAS) Command Injection Vulnerability

Vendor

QNAP

Product

QNAP Network-Attached Storage (NAS)

Added to the catalog

2022-04-11

Due date for US federal agencies

2022-05-02

Weaknesses

CWE-77, CWE-78

Catalog version

2026.10.30

QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://nvd.nist.gov/vuln/detail/CVE-2020-2509

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2021-04-17T04:15:11.327

Last modified

2026-06-17T03:12:15.447

Weaknesses

CWE-77, CWE-78

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

References

• https://www.qnap.com/en/security-advisory/qsa-21-05 (Vendor Advisory)
• https://www.qnap.com/en/security-advisory/qsa-21-05 (Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2509 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:51.476Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-2509

CVE record

Title (CNA)

Command Injection Vulnerability in QTS and QuTS hero

Assigner

qnap

State

PUBLISHED

Published

2021-04-17T03:50:12.655Z

Updated

2025-10-21T23:25:49.063Z

Problem types

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 OS Command Injection

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

References

• https://www.qnap.com/en/security-advisory/qsa-21-05

Read on 2026-11-03T01:04:05.074Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/2xxx/CVE-2020-2509.json

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/