Critical severity · published Feb 3, 2021
CVE-2020-2506
improper access control vulnerability in Helpdesk
In wildKEV
9.8
CVSS
2%
EPSS
Yes
On KEV
Description
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 25, 2022
Federal remediation dueApr 15, 2022
Ransomware campaign useNot known
Affected products
Which versions
HE
Helpdesk · QNAP Systems Inc.
before 3.0.3 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-2506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-2506
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.qnap.com/zh-tw/security-advisory/qsa-20-08
More from Helpdesk
4.8
CVE-2024-27125
A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk