CVE-2024-48864
Published: 07 March 2025
Description
Adversaries may transfer tools or other files from an external system into a compromised environment.
Security Summary
CVE-2024-48864 is a files or directories accessible to external parties vulnerability (CWE-552) affecting QNAP's File Station 5. Published on 2025-03-07, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its potential for high confidentiality and integrity impacts without availability disruption.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables them to read and write arbitrary files or directories accessible through File Station 5, potentially leading to unauthorized data access, modification, or persistence on the targeted system.
QNAP has mitigated the issue in File Station 5 version 5.5.6.4741 and later releases. Administrators should update to these patched versions promptly. Additional details are available in the vendor's security advisory at https://www.qnap.com/en/security-advisory/qsa-24-55.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability in the public-facing File Station application enables remote unauthenticated exploitation (T1190). It directly permits reading arbitrary files (T1005: Data from Local System) and writing files (T1105: Ingress Tool Transfer).