The headline alone does not identify a CVE or QNAP advisory, so it is not enough to determine whether a particular NAS is at risk. One documented example is QNAP’s critical QSA-24-09 advisory, published March 9, 2024, which covers six vulnerabilities across several QNAP operating systems and applications. Check the specific advisory, model and installed software, then apply the update QNAP lists for that product.
What does “Critical Vulnerability Allows Access to QNAP NAS Devices” refer to?
Without a CVE number, advisory ID or publication date, the headline cannot be matched conclusively to one vulnerability. QNAP’s QSA-24-09 is a relevant example: QNAP rated it Critical and marked it Resolved. It is a multi-vulnerability advisory, not proof that every QNAP NAS—or every issue described in it—allows unauthenticated access from the internet.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
QNAP TS-464-8G-US 4 Bay Desktop NAS | $494.00 | Buy on Amazon |
| 2 |
|
QNAP TR-004 4 Bay USB Type-C Direct Attached Storage (DAS) with hardware RAID (Diskless) | $219.00 | Buy on Amazon |
| 3 |
|
QNAP TS-264-8G-US 2 Bay Desktop NAS | $384.00 | Buy on Amazon |
| 4 |
|
QNAP TS-216G-US 2-Bay 2.5GbE Desktop NAS | $299.00 | Buy on Amazon |
| 5 |
|
QNAP TS-433-4G-US 4 Bay NAS | $476.88 | Buy on Amazon |
QSA-24-09 lists CVE-2024-21899, CVE-2024-21900, CVE-2024-21901, CVE-2024-27124, CVE-2024-32764 and CVE-2024-32766. The flaws have different access requirements and impacts:
- CVE-2024-21899: a remote attacker who has gained user access could compromise system security.
- CVE-2024-21900, CVE-2024-27124 and CVE-2024-32766: a remote attacker with user access could execute arbitrary commands.
- CVE-2024-21901: an attacker with administrator access could inject malicious code.
- CVE-2024-32764: missing authentication for a critical function could let an unprivileged user access and execute certain functions.
Those distinctions matter: “critical” describes the advisory’s severity rating, not a single identical attack path for all six CVEs.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Quad-core Intel N5105/N5095 4-core/4-thread burst up to 2.9 GHz with 8GB DDR4 RAM
- Dual 2.5GbE (2.5G/1G/100M) ports accelerates file sharing across teams and devices or streamline large file transfers
- Dual M.2 PCIe Gen3x2 NVMe SSD slots enable cache acceleration or SSD storage pools for improved performance
- Multiple USB 3.2 Gen 2 ports (type-A) with up to 10Gb/s transfer speeds, allowing compatibility with newer, faster USB drives/expansion enclosures for transferring large media files
- Centrally store and organize personal or family photos, music, and videos
Is my QNAP NAS affected?
For QSA-24-09, QNAP names these affected product lines: QTS 5.x and 4.5.x, QuTS hero h5.x and h4.5.x, QuTScloud c5.x, myQNAPcloud 1.0.x and myQNAPcloud Link 2.4.x. That list does not establish that every device is affected; the relevant operating system branch and installed software version must match.
- Identify the NAS model and confirm that QNAP still provides updates for it.
- Check the installed operating system family, version and build. Distinguish QTS from QuTS hero or QuTScloud; similar version numbers are not interchangeable.
- If installed, check the versions of myQNAPcloud and myQNAPcloud Link in App Center as well as the NAS operating system.
- Compare each installed version with the fixed-version threshold in QSA-24-09. For a different headline or CVE, locate the matching entry in QNAP’s security advisory archive rather than assuming QSA-24-09 is the intended notice.
Which versions fix QSA-24-09?
QNAP lists the following minimum fixed versions for this advisory. These are thresholds for QSA-24-09, not universal recommendations for every QNAP product or the latest available releases.
Rank #2
- Direct-attached storage device via USB Type-C for Windows, macOS and Linux
- Use the TR-004 as external storage for NAS backup
- Expand the capacity of your QNAP NAS
- 4 x 3.5-inch SATA 3Gb/s (Diskless)
- Hardware RAID supports RAID 0, 1, 5, JBOD, and individual disks
| Product line | Fixed version listed by QNAP |
|---|---|
| QTS 5.x | QTS 5.1.3.2578 build 20231110 and later |
| QTS 4.5.x | QTS 4.5.4.2627 build 20231225 and later |
| QuTS hero h5.x | h5.1.3.2578 build 20231110 and later |
| QuTS hero h4.5.x | h4.5.4.2626 build 20231225 and later |
| QuTScloud c5.x | c5.1.5.2651 and later |
| myQNAPcloud 1.0.x | 1.0.52 (2023/11/24) and later |
| myQNAPcloud Link 2.4.x | 2.4.51 and later |
Use the threshold for the exact product line and branch; do not compare, for example, a QuTS hero version against a QTS threshold. If your model does not offer the listed branch or update, consult its product support information and the advisory rather than installing firmware intended for another model.
How do I update QNAP NAS firmware and applications?
Update QTS, QuTS hero or QuTScloud
- Sign in to the NAS administration interface.
- Open Control Panel > System > Firmware Update.
- Choose Live Update and check for updates available to that device. Install the applicable update following QNAP’s prompts.
- If Live Update does not offer the needed package, use QNAP’s Download Center to obtain the update for the specific device and follow QNAP’s manual installation instructions.
Update myQNAPcloud applications
For myQNAPcloud or myQNAPcloud Link, use App Center to check for and install the applicable application update. An operating-system update and an application update are separate checks when both components are installed.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #3
- Intel Quad-core CPU burst up to 2.9 GHz with 8GB RAM
- Dual 2.5GbE (2.5G/1G/100M) ports accelerates file sharing across teams and devices or streamline large file transfers
- Dual M.2 PCIe Gen3x2 NVMe SSD slots enable cache acceleration or SSD storage pools for improved performance
- Multiple USB 3.2 Gen 2 ports (type-A) with up to 10Gb/s transfer speeds, allowing compatibility with newer, faster USB drives/expansion enclosures for transferring large media files
- Centrally store and organize personal or family photos, music, and videos
What if the NAS does not show an update?
- Verify the model, operating-system branch and installed build against the advisory; a version from another branch is not a valid comparison.
- Check the product-specific download and support information for the NAS. Availability can depend on the exact model.
- Check App Center separately for myQNAPcloud components named in the advisory.
- If the headline names another CVE or advisory, use that exact notice: QSA-24-09’s fixed versions do not resolve every QNAP vulnerability.
QNAP’s recommendation in QSA-24-09 is to “regularly update your system and applications to the latest version to benefit from vulnerability fixes.” The vendor’s advisory archive is the appropriate place to follow new notices and confirm remediation for a particular issue.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Does this mean I need to replace my NAS?
QSA-24-09’s stated remediation is to update affected system software and applications; it does not tell owners to buy a replacement device. If the model is no longer supported or cannot receive the applicable fix, the cited advisory does not establish a replacement path, so confirm the model’s support status with QNAP before deciding what to do.
Quick Recap
Best Value
- ARM Cortex-A55 quad-core 2.0GHz processor with 4 GB DDR4 RAM
- Future-proof high speed 2.5GbE port x 1, 1GbE port x 1
- Budget-friendly home NAS for file storage and multimedia streaming
- Centrally store and organize personal or family photos, music, and videos
- Effortlessly backup your Windows Computers with QNAP’s NetBak Replicator software and Mac computers with Time Machine
Rank #4
- ARM Cortex-A55 quad-core 2.0GHz processor with 4 GB DDR4 RAM
- Built-in NPU for AI Acceleration to boost performance for high-speed face and object recognition.
- 2.5GbE (2.5G/1G/100M) ports accelerates file sharing across teams and devices or streamline large file transfers
- Budget-friendly Home NAS for file storage and multimedia streaming
- Centrally store and organize personal or family photos, music, and videos
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
