CVEvulnerability

CVE-2020-2506

9.8 CRITICAL Known exploited Published 2021-02-03 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

QNAP Helpdesk Improper Access Control Vulnerability — QNAP Systems Helpdesk

QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.

Added to KEV
2022-03-25
Remediation due
2022-04-15
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-2506
Status
Analyzed
Published
2021-02-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-284

Description

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

Affected configurations

• qnap helpdesk (< 3.0.3)

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References