0X14

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions prior to 4.5.4.2790 build 20240605 QNAP QuTS hero versions prior to h4.5.4.2790 build 20240606 **Description** An OS command injection issue has been reported to affect several QNAP operating system versions. If exploited, the issue could allow authenticated administrators to execute commands via a network. **Recommendations** For QNAP QTS versions prior to 4.5.4.2790 build 20240605, update to QTS 4.5.4.2790 build 20240605 or later. For QNAP QuTS hero versions prior to h4.5.4.2790 build 20240606, update to QuTS hero h4.5.4.2790 build 20240606 or later.

**Name of the Vulnerable Software and Affected Versions** D-Link DIR-846 version 1.00A52 **Description** The issue is related to the implementation of the HNAP1 protocol in the D-Link DIR-846 router's firmware, specifically concerning the handling of the `tomography ping address` parameter. This can be exploited by sending specially crafted requests to the `/HNAP1` interface, potentially allowing a remote attacker to execute arbitrary commands. **Recommendations** For D-Link DIR-846 version 1.00A52, consider restricting access to the `/HNAP1` interface until a patch is available. As a temporary workaround, avoid using the `tomography ping address` parameter in the affected interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.