CVE-2020-2509 QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
From the CISA KEV catalogue version 2026.11.06, with Cybergen analysis. Updated 6 Nov 2026.
Should You Worry?
- CISA confirmed exploitation in the wild and added it to the Known Exploited Vulnerabilities catalogue on 11 Apr 2022.
- Rated Critical severity (CVSS 9.8, scored by CISA).
- It has been in the catalogue for 1,670 days. Systems still unpatched now have almost certainly been scanned for it.
What It Is
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later
Affected Versions
| Product | Versions |
|---|---|
| QNAP Systems Inc. QTS | unspecified to before 4.5.2.1566 Build 20210202 unspecified to before 4.5.1.1495 Build 20201123 unspecified to before 4.3.6.1620 Build 20210322 unspecified to before 4.3.4.1632 Build 20210324 unspecified to before 4.3.3.1624 Build 20210416 unspecified to before 4.2.6 Build 20210327 |
| QNAP Systems Inc. QuTS hero | unspecified to before h4.5.1.1491 build 20201119 |
From the public CVE record, as supplied by the vendor. Always confirm against the vendor advisory.
What To Do Now
- 1
Find it
Search your asset inventory and external attack surface for QNAP Network-Attached Storage (NAS). Include cloud images, appliances and anything a supplier runs for you.
Attack Surface Management - 2
- 3
Hunt for compromise
If an affected system was reachable before you patched, assume it may have been hit. Check logs, new accounts, web shells and outbound connections from the date of exposure.
Incident Response - 4
Prove it is fixed
Rescan or test the system after patching. Upgrades that fail silently and forgotten secondary instances are common.
Penetration Testing
Vendor Advisories
The Compliance Clock
General guidance, not legal advice. Your obligations depend on your sector, scope and jurisdiction.
Not Sure If You Are Exposed?
Our attack surface and vulnerability teams can check your internet-facing estate for CVE-2020-2509 and every other exploited flaw on the list.