EXPLOIT QNAP NAS Hybrid Backup Remote Code Execution Vulnerability (CVE-2021-28809)

Rule ID

1139487

Severity

Medium

Description

The specific flaw exists within the RTSS server, which listens on TCP port 8899 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute arbitrary code in the context of the Administrator.

Impact

Remote command execution

Recommendation

Update vendor's patch.

IPS Category

Exploits

IPS Anomaly Group

N/A

IPS Rule Default Action

Allow

Reference

Keyword

N/A