{"id":"CVE-2020-2509","published":"2021-04-17T04:15:11Z","modified":"2026-06-17T03:12:15Z","title":"QNAP Network-Attached Storage (NAS) Command Injection Vulnerability","vendor":"QNAP","product":"QNAP Network-Attached Storage (NAS)","tier":"core","eol":null,"description":{"text":"A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw in QNAP Network-Attached Storage (NAS) devices running QTS and QuTS hero, where improper neutralisation of special elements used in an OS command lets input reach the operating system's command handling. An attacker with network access and no authentication or user interaction, under the default configuration, could execute arbitrary commands within a compromised application on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:49Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.33987,"percentile":0.98391,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-04-11","dueDate":"2022-05-02","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-2509","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-04-11","exploitedFirstSeen":"2022-04-11","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-11"},{"url":"https://cisa.gov/news-events/alerts/2022/04/27/2021-top-routinely-exploited-vulnerabilities","date":"2022-04-28"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-117a","date":"2022-04-28"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-21-05","tags":["Vendor Advisory"]},{"url":"https://www.qnap.com/en/security-advisory/qsa-21-05","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2509","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated network-facing service exploited","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"A command injection vulnerability has been reported to affect QTS and QuTS hero","start":0,"end":79}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary command execution is the direct impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows attackers to execute arbitrary commands in a compromised application","start":114,"end":189}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-22302","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22302","exploited":true,"exploitedSince":"2022-04-11","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2022-07-27","earliestUrl":"https://github.com/jbaines-r7/overkill","repos":[{"name":"jbaines-r7/overkill","url":"https://github.com/jbaines-r7/overkill","stars":14,"created":"2022-07-27"}]},"first":{"date":"2022-07-27","source":"PoC-in-GitHub","url":"https://github.com/jbaines-r7/overkill"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-04-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2509","provenance":"source"},{"date":"2022-04-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-04-11","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22302","provenance":"source"},{"date":"2022-07-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/jbaines-r7/overkill","provenance":"source"}],"speed":{"daysToPublicExploit":466,"firstExploitFrom":"PoC-in-GitHub","daysToKev":359},"priority":{"score":79.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1662 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.68,"detail":"percentile 0.9839"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}