CVE-2020-2504

Name of the Vulnerable Software and Affected Versions QNAP QES versions prior to 2.1.1 Build 20201006

Description This issue is related to an absolute path traversal vulnerability that could allow attackers to traverse files in File Station. The vulnerability is also associated with inadequate access control in the QES operating system, which could enable a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 2.1.1 Build 20201006, update to QES 2.1.1 Build 20201006 or later to resolve the issue. As a temporary workaround, consider restricting access to the File Station to minimize the risk of exploitation.