Vulnerability in QuLog Center, Legacy QTS, and Legacy QuTS hero

Summary

A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center and legacy versions of QTS and QuTS hero. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data.

We have already fixed the vulnerability in the following versions:

Recommendation

To fix the vulnerability, we recommend updating QuLog Center and your operating system to the latest version.

Updating QuLog Center

1. Log in to QTS or QuTS hero as an administrator.
2. Open App Center and then click .
   A search box appears.
3. Type "QuLog Center" and then press ENTER.
   QuLog Center appears in the search results.
4. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if your QuLog Center is already up to date.
5. Click OK.
   The application is updated.

Updating QTS or QuTS hero

1. Log in to QTS or QuTS hero as an administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.