Network-attached storage (NAS) maker QNAP is working on security updates to patch remote code execution and denial-of-service (DoS) vulnerabilities.
The security vulnerabilities traced as CVE-2021-3711 and CVE-2021-3712 affect QNAP NAS devices running QTS, QuTS hero, QuTScloud and HBS 3 Hybrid Backup Sync as backup and disaster recovery apps.
The heap-based buffer overflow in the SM2 cryptographic algorithm behind CVE-2021-3711 might potentially lead to crashes and the execution of arbitrary code by threat actors.
The CVE-2021-3712 vulnerability is caused by a read buffer overrun weakness while processing ASN.1 strings, which could be exploited by hackers to crash vulnerable apps or gain entry to private memory contents such as private keys or similar sensitive information.
As QNAP explains, the vulnerabilities allow remote attackers, if successfully exploited, to obtain unauthorized access to memory data, trigger DoS states, or execute arbitrary code with the privileges of the user running the HBS 3 app.
For more information, view the original story from Bleeping Computer.
