QNAP released security updates addressing CVE-2024-50388 (CVSS 9.5), a critical operating system command injection vulnerability in its Hybrid Backup Sync (HBS 3) disaster recovery and data backup solution. Classified under CWE-77 and CWE-78, the flaw stems from improper input neutralization in HBS 3’s request-handling routines. Remote attackers can transmit crafted requests containing unescaped shell metacharacters, breaking out of intended execution wrappers to execute arbitrary system commands on underlying QTS and QuTS hero operating systems with elevated administrative privileges.

The zero-day vulnerability was demonstrated during the Pwn2Own Ireland 2024 competition in Cork, where Viettel Cyber Security researchers Ha The Long and Ha Anh Hoang chained the flaw to fully compromise an exposed QNAP TS-464 NAS device. Because HBS 3 frequently runs on storage appliances maintaining broad access across local networks and cloud storage repositories, unauthenticated command execution presents an immediate vector for network intrusion and ransomware staging. QNAP patched the flaw in advisory QSA-24-41, releasing HBS 3 version 25.1.1.673 for QTS 5.1/5.2 and QuTS hero h5.1/h5.2.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Command injection directly subverts the boundary integrity of backup appliances, granting attackers shell execution with underlying daemon rights and enabling disk modification, credential theft, and lateral migration without relying on pre-existing host access.
• Bullet 2 — Strategic & Defender Imperative: Administrators must immediately update HBS 3 via the QTS/QuTS hero App Center to version 25.1.1.673 or higher, isolate NAS management and synchronization endpoints from public internet routing, and enforce strict ingress firewall rules.