QNAP fixed second zero-day demonstrated at Pwn2Own Ireland 2024
October 31, 2024 
QNAP addressed the second zero-day vulnerability demonstrated by security researchers during the recent Pwn2Own Ireland 2024.
Taiwanese manufacturer QNAP patched the second zero-day vulnerability, tracked as CVE-2024-50387, which was exploited by security researchers during the recent Pwn2Own Ireland 2024.
The vulnerability is a SQL injection (SQLi) issue that impacts the QNAP’s SMB Service.
The researcher YingMuo (@YingMuo) of the DEVCORE Internship Program chained an argument injection and a SQL injection to achieve a root shell on the QNAP TS-464 NAS. The team earned $20,000 and 4 Master of Pwn points.
The vendor addressed the vulnerability with the release of versions 4.15.002 or later and h4.15.002 and later.
This week QNAP addressed another critical zero-day vulnerability, tracked as CVE-2024-50388, which was exploited by white hat hackers against a TS-464 NAS device during the recent Pwn2Own Ireland 2024 hacking competition.
The flaw is an OS command injection vulnerability in HBS 3 Hybrid Backup Sync, a remote attacker could exploit it to execute arbitrary code commands on vulnerable devices.
The vulnerability impacts version 25.1.x and was addressed in HBS 3 Hybrid Backup Sync 25.1.1.673 and later
“An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.” reads the advisory published by the Taiwanese manufacturer.
On Day three of the Pwn2Own Ireland 2024 competition, Ha The Long with Ha Anh Hoang of Viettel Cyber Security (@vcslab) used a single command injection bug to exploit the QNAP TS-464 NAS. Their fourth-round win nets them $10,000 and 4 Master of Pwn points.
Despite vendors have 90 days until Trend Micro’s Zero Day Initiative publicly discloses details on exploits demonstrated during the contest, QNAP quickly addressed both vulnerabilities demonstrated during Pwn2Own Ireland 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Pwn2Own Ireland 2024)