Unscored severity · published Sep 21, 2009
CVE-2009-3200
The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory,…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable, deobfuscating the key, and running a cryptsetup luksOpen command.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TP
Ts-239 Pro Turbo Nas · Qnap
2.1.7_0613; 3.1.0_0627; 3.1.1_0815 · source: NVD
TP
Ts-639 Pro Turbo Nas · Qnap
2.1.7_0613; 3.1.0_0627; 3.1.1_0815 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3200
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3200
forum.qnap.com
http://forum.qnap.com/viewtopic.php?f=11&t=11214&start=20#p63346
forum.qnap.com
http://forum.qnap.com/viewtopic.php?f=12&t=12104&start=10#p63341
secunia.com
http://secunia.com/advisories/36793
Exploit
http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/506607/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/36467
More from Ts-239 Pro Turbo Nas
–
CVE-2009-3279
The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create a LUKS partition by using the AES-256 cipher in plain CBC mode, which allows local…