CVE-2017-6361

Imagine your QNAP storage box has a “back door” that doesn’t require a password. With CVE-2017-6361, someone who can reach it over the network can run commands on the device, like pulling data, changing settings, or stopping the service. This matters most if the device is reachable from outside your business network.

This matters to you if you run a QNAP storage device using QTS older than 4.2.4 Build 20170313. It is a risk specifically for network-reachable devices because attackers do not need to log in or interact with you. Note: it is marked as not reachable in the default configuration, so the exposure depends on how your device is connected (for example, internet exposure via routing/firewall rules).

This is urgent because the flaw allows attackers to run arbitrary commands over the network without authentication, which is the kind of access attackers use to take over systems and steal data. The device is not confirmed in KEV, but a public exploit exists and press attention is rising, so you should treat it as an active risk and patch.

1. Confirm exposure

   • Log in to the QNAP admin interface.
   • Locate the firmware/system information and record the QTS version/build.
   • If your QTS is earlier than 4.2.4 Build 20170313, you are likely affected.

2. Patch (primary fix)

   • Upgrade QTS to 4.2.4 Build 20170313 or later.
   • Use the firmware update method provided by QNAP for your exact model and follow QNAP’s upgrade steps.
   • After upgrading, confirm the version/build now shows 4.2.4 Build 20170313 or later.

3. Reduce “internet reachability” (important for this issue)

   • Ensure the QNAP is not directly reachable from the public internet.
   • Remove any port-forwarding rules pointing to the QNAP.
   • If you use UPnP, disable it on your router (or ensure it cannot expose the QNAP).
   • Prefer restricting access to your office network and/or VPN.

4. Validate after remediation

   • Check that services still behave as expected (shared folders, backups, and remote access features).
   • Review the QNAP logs for unusual login/connection attempts around the time of any public exposure (even though this flaw does not require login, connection attempts may still appear).

5. Temporary workaround if you can’t patch immediately

   • Immediately restrict network access to only trusted networks (VPN/office IP ranges) and block all public inbound traffic to the QNAP.
   • This won’t replace patching, but it reduces the chance an attacker can reach the vulnerable component.

6. What to monitor

   • Continued firmware release status from QNAP for your model.
   • Any new inbound scans/connection attempts at your firewall/router.
   • QNAP system/security logs for abnormal activity after the upgrade.

Severity is high because the weakness is classic command injection (CWE-78) resulting in full control: an attacker can execute arbitrary commands, gaining the ability to read data, change settings, or shut down the service. The attack is network-based and does not require authentication or user interaction. A public exploit is available (weaponized), and press attention is rising; however, this specific CVE is not listed in CISA KEV. The traffic-light verdict for this issue is AMBER, reflecting strong potential impact with conditions tied to network reachability (not reachable in the default configuration). EPSS is a prediction (and not a substitute for patching); exploitation maturity is supported by availability of a public exploit.