CVE-2020-2504 is an absolute path traversal vulnerability affecting QNAP QES operating systems, specifically in File Station. This flaw allows unauthenticated attackers to traverse arbitrary files, potentially leading to unauthorized information disclosure. With a CVSS score of 7.5 (High), it is easily exploitable over the network with low attack complexity, but only impacts confidentiality. While not listed in CISA's KEV catalog, there is limited community discussion and media coverage, and no public exploit code or active exploitation has been observed. QNAP has released fixes in QES 2.1.1 Build 20201006 and later.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.1.1CPE matchmatch criteria | cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:* | ||
2.1.1CPE matchmatch criteria | cpe:2.3:a:qnap:qes:2.1.1:-:*:*:*:*:*:* | ||
2.1.1CPE matchmatch criteria | cpe:2.3:a:qnap:qes:2.1.1:build_20200211:*:*:*:*:*:* | ||
2.1.1CPE matchmatch criteria | cpe:2.3:a:qnap:qes:2.1.1:build_20200303:*:*:*:*:*:* | ||
2.1.1CPE matchmatch criteria | cpe:2.3:a:qnap:qes:2.1.1:build_20200319:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.