Description
QNAP Systems 是一家提供网络存储解决方案的公司，其产品包括 QTS、QuTS hero 和 QuTScloud 等操作系统。这些系统中 /cgi-bin/priv/privWizard.cgi 接口存在权限绕过漏洞。攻击者可以利用该漏洞绕过身份验证，获取未授权的访问权限，可能导致敏感信息泄露或系统被进一步攻击。
QNAP QTS 多款设备 /cgi-bin/priv/privWizard.cgi 权限绕过漏洞（CVE-2024-21899）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-21899
https://www.qnap.com/en/security-advisory/qsa-24-09
https://www.sentinelone.com/vulnerability-database/cve-2024-21899/
https://github.com/advisories/GHSA-mfjq-7ffc-qgmv
https://www.manchesterdigital.com/post/arcticwolf/cve-2024-21899-critical-authentication-bypass-vulnerability-in-qnap-products
https://securityaffairs.com/160217/iot/qnap-nas-products-flaws.html
https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-21899
https://cvefeed.io/vuln/detail/CVE-2024-21899
https://borncity.com/win/2024/03/12/critical-vulnerability-cve-2024-21899-allows-qnap-nas-access-without-authentication/
https://www.tenable.com/plugins/ot/502517