CVE-2020-2506
CVE-2020-2506 is a security flaw in QNAP Systems Helpdesk, a network drive for storing files and backups at home or in a small office. Attackers can reach parts of QNAP Systems Helpdesk that should be locked to them. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 25 Mar 2022.[1]
QNAP Systems Helpdesk is in things households have: network drives for files and backups, so the fix matters at home as much as at work. Fixed in version 3.0.3 of Helpdesk.
Description
CISA calls it a QNAP helpdesk improper access control in QNAP Systems Helpdesk. In its words: “QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.”[1]
The CVE record adds: “The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.”[2]
The underlying weakness is improper access control (CWE-284), in MITRE’s list of common software weaknesses.
It scores 9.8 out of 10 on the Common Vulnerability Scoring System, which rates it critical, scored by NVD using CVSS 3.1.[2]
Affected versions
NVD’s record lists one fixed version: everything before it is affected.[2]
| Product | Fixed in |
|---|---|
| Helpdesk | 3.0.3 |
Every device with QNAP Systems Helpdesk needs the update.
Exploitation
CISA added it to its catalog of known exploited vulnerabilities on 25 Mar 2022, 415 days after it was made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 15 Apr 2022 to fix it.[1]
FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at 2%. That’s in the top 20% of the flaws it scores.[4]
CISA assesses it as automatable: attackers can run it against many targets at once.
CISA doesn’t say who was attacked, or how.
Fix
QNAP Systems has published a fix or advice.[3] CISA’s required action: “Apply updates per vendor instructions.”[1]
- Update QNAP Systems Helpdesk now.Install the latest update from QNAP Systems on every device that has it, and restart when asked. Then turn on automatic updates, so the next fix arrives on its own.
- Check you’re on 3.0.3 or later.Fixed in version 3.0.3 of Helpdesk. Anything older is what attackers are going after.
- If the maker has stopped updating it, replace it.Network drives stop getting fixes after a few years, and attackers keep a list of the ones that did. If there’s no newer firmware, it won’t be fixed.
Timeline
| Date | Event |
|---|---|
| The flaw is made public in the National Vulnerability Database, with a severity score of 9.8.[2] | |
| CISA adds it to its catalog of flaws known to be used in attacks.[1] | |
| CISA’s deadline for US government agencies to fix it.[1] | |
| FIRST puts the odds of it being used in attacks in the next 30 days at 2%.[4] |
See also
Other improper access control flaws
- CVE-2015-3306, ProFTPD: improper access control ·
- CVE-2026-21962, Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: improper access control ·
- CVE-2026-56290, Joomlack Page Builder: improper access control ·
- CVE-2026-34908, Ubiquiti UniFi OS: improper access control ·
- CVE-2026-48907, Widget Factory Joomla Content Editor: improper access control ·
Added the same day
- CVE-2022-26318, WatchGuard Firebox and XTM Appliances: arbitrary code execution ·
- CVE-2022-26143, Mitel MiCollab, MiVoice Business Express: access control ·
- CVE-2022-21999, Microsoft Windows: print spooler privilege escalation ·
- CVE-2021-42237, Sitecore XP: remote command execution ·
- CVE-2021-22941, Citrix ShareFile: improper access control ·
References
- ^ Cybersecurity and Infrastructure Security Agency. “QNAP Helpdesk Improper Access Control Vulnerability”. Known Exploited Vulnerabilities Catalog, added 25 Mar 2022.
- ^ National Institute of Standards and Technology. “CVE-2020-2506 Detail”. National Vulnerability Database, published 3 Feb 2021.
- ^ QNAP Systems. Advisories and fixes: qnap.com.
- ^ FIRST. “Exploit Prediction Scoring System”. EPSS 0.020, percentile 80.8, 31 Oct 2026.
- CVE Program. “CVE-2020-2506”. The official CVE record.
This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.