Command Injection Vulnerability in Malware Remover

Summary

A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands.

We have already fixed the issue in the following versions:

• QTS 4.4.x: Malware Remover 4.6.1.0 and later

QNAP NAS running Malware Remover 3.x are not affected.

Recommendation

To fix the vulnerability, we recommend updating Malware Remover to the latest version.

Updating Malware Remover

1. Log on to QTS as administrator.
2. Open the App Center and then click .
A search box appears.

3. Type “Malware Remover” and then press ENTER.
   Malware Remover appears in the search results.
4. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if your Malware Remover is already up to date.
5. Click OK.
   The application is updated.