QNAP’s patches for the SQLi issue come just days after it addressed another zero-day impacting its HBS 3 Hybrid Backup Sync disaster recovery and data backup solution, which was discovered and leveraged by the Viettel Cyber Security team to compromise a TS-464 network-attached storage device during the competition. Immediate implementation of the released patches has been urged as QNAP devices remain highly targeted by threat actors, with organizations instructed to apply the fixes by logging in as admin to QuTS hero or QTS and clicking “Update”

Source: SC Magazine