CVE-2020-2506 kev in the critical feed json
improper access control vulnerability in Helpdesk
published 5y ago modified 4mo ago also EUVD-2020-22299
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-03-25
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
Patch / fix
cisa required action Apply updates per vendor instructions.
- QNAP Systems Inc. Helpdesk 3.0.3
Is CVE-2020-2506 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4y ago
- Patch by
- 2022-04-15 (4y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- QNAP Systems, Helpdesk
- CISA name
- QNAP Helpdesk Improper Access Control Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
2.01% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- QNAP Systems Inc. Helpdesk
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
qnap.com
/zh-tw/security-advisory/qsa-20-08
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2506
government-resource, us-government-resource
Sources
- CVE List CVE-2020-2506
- NVD CVE-2020-2506
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.